dpkg Patches Directory Traversal Vulnerability

Bugtraq ID:	45703
Class:	Input Validation Error
CVE:	CVE-2010-1679 CVE-2011-0402
Remote:	Yes
Local:	No
Published:	Jan 05 2011 12:00AM
Updated:	May 07 2015 05:02PM
Credit:	Jakub Wilk
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 GNU Patch 0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian dpkg 0
Not Vulnerable:

dpkg Patches Directory Traversal Vulnerability

dpkg is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to modify files outside the destination directory and possibly gain access to the system.

dpkg Patches Directory Traversal Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to unpack a malicious package.

dpkg Patches Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu dpkg-dev_1.15.4ubuntu2.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.4ubun tu2.3_all.deb


• Ubuntu dpkg_1.15.4ubuntu2.3_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_sparc.de b


• Ubuntu dselect_1.15.4ubuntu2.3_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_sparc .deb

Ubuntu Ubuntu Linux 10.10 amd64

• Ubuntu dpkg-dev_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.8.4ub untu3.1_all.deb


• Ubuntu dpkg_1.15.8.4ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu 3.1_amd64.deb


• Ubuntu dselect_1.15.8.4ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.8.4ubu ntu3.1_amd64.deb


• Ubuntu libdpkg-dev_1.15.8.4ubuntu3.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-dev_1.15.8. 4ubuntu3.1_amd64.deb


• Ubuntu libdpkg-perl_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-perl_1.15.8 .4ubuntu3.1_all.deb

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu dpkg-dev_1.15.5.6ubuntu4.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.5.6ub untu4.5_all.deb


• Ubuntu dpkg_1.15.5.6ubuntu4.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_powerp c.deb


• Ubuntu dselect_1.15.5.6ubuntu4.5_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_pow erpc.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu dpkg-dev_1.15.4ubuntu2.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.4ubun tu2.3_all.deb


• Ubuntu dpkg_1.15.4ubuntu2.3_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.4ubuntu2. 3_i386.deb


• Ubuntu dselect_1.15.4ubuntu2.3_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.4ubunt u2.3_i386.deb

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu dpkg-dev_1.15.5.6ubuntu4.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.5.6ub untu4.5_all.deb


• Ubuntu dpkg_1.15.5.6ubuntu4.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu 4.5_amd64.deb


• Ubuntu dselect_1.15.5.6ubuntu4.5_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.5.6ubu ntu4.5_amd64.deb

Ubuntu Ubuntu Linux 10.10 powerpc

• Ubuntu dpkg-dev_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.8.4ub untu3.1_all.deb


• Ubuntu dpkg_1.15.8.4ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1_powerp c.deb


• Ubuntu dselect_1.15.8.4ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.8.4ubuntu3.1_pow erpc.deb


• Ubuntu libdpkg-dev_1.15.8.4ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/libdpkg-dev_1.15.8.4ubuntu3.1 _powerpc.deb


• Ubuntu libdpkg-perl_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-perl_1.15.8 .4ubuntu3.1_all.deb

Ubuntu Ubuntu Linux 9.10 ARM

• Ubuntu dpkg-dev_1.15.4ubuntu2.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.4ubun tu2.3_all.deb


• Ubuntu dpkg_1.15.4ubuntu2.3_armel.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_armel.de b


• Ubuntu dselect_1.15.4ubuntu2.3_armel.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_armel .deb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu dpkg-dev_1.15.4ubuntu2.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.4ubun tu2.3_all.deb


• Ubuntu dpkg_1.15.4ubuntu2.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_powerpc. deb


• Ubuntu dselect_1.15.4ubuntu2.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_power pc.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu dpkg-dev_1.15.4ubuntu2.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.4ubun tu2.3_all.deb


• Ubuntu dpkg_1.15.4ubuntu2.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.4ubuntu2. 3_amd64.deb


• Ubuntu dselect_1.15.4ubuntu2.3_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.4ubunt u2.3_amd64.deb

Ubuntu Ubuntu Linux 10.04 ARM

• Ubuntu dpkg-dev_1.15.5.6ubuntu4.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.5.6ub untu4.5_all.deb


• Ubuntu dpkg_1.15.5.6ubuntu4.5_armel.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_armel. deb


• Ubuntu dselect_1.15.5.6ubuntu4.5_armel.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_arm el.deb

Ubuntu Ubuntu Linux 10.10 ARM

• Ubuntu dpkg-dev_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.8.4ub untu3.1_all.deb


• Ubuntu dpkg_1.15.8.4ubuntu3.1_armel.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1_armel. deb


• Ubuntu dselect_1.15.8.4ubuntu3.1_armel.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.8.4ubuntu3.1_arm el.deb


• Ubuntu libdpkg-dev_1.15.8.4ubuntu3.1_armel.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/libdpkg-dev_1.15.8.4ubuntu3.1 _armel.deb


• Ubuntu libdpkg-perl_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-perl_1.15.8 .4ubuntu3.1_all.deb

Ubuntu Ubuntu Linux 10.10 i386

• Ubuntu dpkg-dev_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.8.4ub untu3.1_all.deb


• Ubuntu dpkg_1.15.8.4ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu 3.1_i386.deb


• Ubuntu dselect_1.15.8.4ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.8.4ubu ntu3.1_i386.deb


• Ubuntu libdpkg-dev_1.15.8.4ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-dev_1.15.8. 4ubuntu3.1_i386.deb


• Ubuntu libdpkg-perl_1.15.8.4ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-perl_1.15.8 .4ubuntu3.1_all.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu dpkg-dev_1.15.4ubuntu2.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.4ubun tu2.3_all.deb


• Ubuntu dpkg_1.15.4ubuntu2.3_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_lpia.deb


• Ubuntu dselect_1.15.4ubuntu2.3_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_lpia. deb

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu dpkg-dev_1.15.5.6ubuntu4.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.5.6ub untu4.5_all.deb


• Ubuntu dpkg_1.15.5.6ubuntu4.5_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_sparc. deb


• Ubuntu dselect_1.15.5.6ubuntu4.5_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_spa rc.deb

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu dpkg-dev_1.15.5.6ubuntu4.5_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.5.6ub untu4.5_all.deb


• Ubuntu dpkg_1.15.5.6ubuntu4.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu 4.5_i386.deb


• Ubuntu dselect_1.15.5.6ubuntu4.5_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.5.6ubu ntu4.5_i386.deb

dpkg Patches Directory Traversal Vulnerability

References:

• CVE request: patch directory traversal flaw (Vincent Danen)
  
• dpkg Package Homepage (Debian)
  
• Subject: [bug-patch] Directory traversal vulnerability in patch (or dpkg-source) (Jakub Wilk)