Ubuntu 1038-1: dpkg vulnerability

    Date06 Jan 2011
    CategoryUbuntu
    401
    Posted ByLinuxSecurity Advisories
    Jakub Wilk and Raphaël Hertzog discovered that dpkg-source did not correctly handle certain paths and symlinks when unpacking source-format version 3.0 packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial [More...]
    ===========================================================
    Ubuntu Security Notice USN-1038-1          January 06, 2011
    dpkg vulnerability
    CVE-2010-1679
    ===========================================================
    
    A security issue affects the following Ubuntu releases:
    
    Ubuntu 9.10
    Ubuntu 10.04 LTS
    Ubuntu 10.10
    
    This advisory also applies to the corresponding versions of
    Kubuntu, Edubuntu, and Xubuntu.
    
    The problem can be corrected by upgrading your system to the
    following package versions:
    
    Ubuntu 9.10:
      dpkg-dev                        1.15.4ubuntu2.3
    
    Ubuntu 10.04 LTS:
      dpkg-dev                        1.15.5.6ubuntu4.5
    
    Ubuntu 10.10:
      dpkg-dev                        1.15.8.4ubuntu3.1
    
    In general, a standard system update will make all the necessary changes.
    
    Details follow:
    
    Jakub Wilk and Raphaël Hertzog discovered that dpkg-source did not
    correctly handle certain paths and symlinks when unpacking source-format
    version 3.0 packages. If a user or an automated system were tricked into
    unpacking a specially crafted source package, a remote attacker could
    modify files outside the target unpack directory, leading to a denial
    of service or potentially gaining access to the system.
    
    
    Updated packages for Ubuntu 9.10:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3.dsc
          Size/MD5:     1369 df5975398ec1f8fa00617dba2a855090
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3.tar.gz
          Size/MD5:  7046765 7bd73bcbd5ff74a2083f51b068c3f071
    
      Architecture independent packages:
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.4ubuntu2.3_all.deb
          Size/MD5:   572590 4a5837b26e895fed592d8e44bc5b89ce
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_amd64.deb
          Size/MD5:  2170884 82de5906f95f9b597a914f2c81659eaf
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_amd64.deb
          Size/MD5:   334238 f02106409df7473ceba2401e273fbad4
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_i386.deb
          Size/MD5:  2123952 6b1f6c7aa590d87bac9a630cb254bfdd
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_i386.deb
          Size/MD5:   325934 a243cff597c7a6b2ce3ea933cbbd2538
    
      armel architecture (ARM Architecture):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_armel.deb
          Size/MD5:  2133956 be580c89987c4bf0729a6b7b0287c324
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_armel.deb
          Size/MD5:   322314 69da8bec9824d131f9fb2d29f3c7531b
    
      lpia architecture (Low Power Intel Architecture):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_lpia.deb
          Size/MD5:  2109942 686414041cd2faade333988894c62721
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_lpia.deb
          Size/MD5:   327130 bfb7291c389f69271b9d8d17097f1450
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_powerpc.deb
          Size/MD5:  2170404 471bebdff42698ce65e19e688ccad114
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_powerpc.deb
          Size/MD5:   333352 e279c421aef7555990a8bc0154964c70
    
      sparc architecture (Sun SPARC/UltraSPARC):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.4ubuntu2.3_sparc.deb
          Size/MD5:  2132714 e743264871c293f5d0c9d5fced9ee297
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.4ubuntu2.3_sparc.deb
          Size/MD5:   327166 e38693753de95099f3c6e0e911c73641
    
    Updated packages for Ubuntu 10.04 LTS:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5.dsc
          Size/MD5:     1351 e9c42a50bdb677925283efd746d26827
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5.tar.bz2
          Size/MD5:  4682350 0404022baa0d35a11724f6268f806f35
    
      Architecture independent packages:
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.5.6ubuntu4.5_all.deb
          Size/MD5:   653864 6eb96a6344c8d86376cc5f02eafd4903
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_amd64.deb
          Size/MD5:  2254322 10b37645fade4011744c91ecf5516d89
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_amd64.deb
          Size/MD5:   407622 025c51b22e0ac7b8f138a5de274231bf
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_i386.deb
          Size/MD5:  2191790 ab0b2dafdb6ba609d82b24dc61e56255
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_i386.deb
          Size/MD5:   402316 3c71bc471c4b78b9794e036e3d8ccfcf
    
      armel architecture (ARM Architecture):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_armel.deb
          Size/MD5:  2175460 e6f606b4848cf051a9acd26c0d5e573a
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_armel.deb
          Size/MD5:   393030 39639fda1a6f61b0024ca06598a8395e
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_powerpc.deb
          Size/MD5:  2239566 54f9658a4096703b403479c2086cd338
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_powerpc.deb
          Size/MD5:   410174 2d3efa6860df00bb1c0ad6af0d16ba22
    
      sparc architecture (Sun SPARC/UltraSPARC):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.5.6ubuntu4.5_sparc.deb
          Size/MD5:  2217050 6175f5d14a3a76b158503992e9d4c28b
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.5.6ubuntu4.5_sparc.deb
          Size/MD5:   406216 bb96dc8b38b8a638ab7ca04f24cb393d
    
    Updated packages for Ubuntu 10.10:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1.dsc
          Size/MD5:     1361 ec294c6bdf531ac3dfb1cf2a039d30ad
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1.tar.bz2
          Size/MD5:  5078410 ba30b2d5e73830c5dbaf520e38d03afe
    
      Architecture independent packages:
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg-dev_1.15.8.4ubuntu3.1_all.deb
          Size/MD5:   772250 5bddb4a4e5802c4688eec68a1a806436
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-perl_1.15.8.4ubuntu3.1_all.deb
          Size/MD5:   504830 21caadb68ae793839dfef2ea71b9a2a7
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1_amd64.deb
          Size/MD5:  2132788 424e34190fc3d2b59f1c3ebb32238cf9
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.8.4ubuntu3.1_amd64.deb
          Size/MD5:   513880 678a5dfec3cf74b420475a2b922f3021
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-dev_1.15.8.4ubuntu3.1_amd64.deb
          Size/MD5:   424950 e56298e2df7c1e9700a90d4723f831d8
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1_i386.deb
          Size/MD5:  2073106 f5b5aab820ac4592a36958974386b587
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/dselect_1.15.8.4ubuntu3.1_i386.deb
          Size/MD5:   508096 95aa9cc62b92e566e87f00cbf6b3076d
        http://security.ubuntu.com/ubuntu/pool/main/d/dpkg/libdpkg-dev_1.15.8.4ubuntu3.1_i386.deb
          Size/MD5:   410698 d93501aa6f9c36ac1803b3e7adb39127
    
      armel architecture (ARM Architecture):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1_armel.deb
          Size/MD5:  2075164 36bbda04079da2aa438a3dcfb61cd65c
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.8.4ubuntu3.1_armel.deb
          Size/MD5:   501672 9878e0c6b70f2f58b70735079d786115
        http://ports.ubuntu.com/pool/main/d/dpkg/libdpkg-dev_1.15.8.4ubuntu3.1_armel.deb
          Size/MD5:   416906 52c402cd837d9635a445ad220a037325
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://ports.ubuntu.com/pool/main/d/dpkg/dpkg_1.15.8.4ubuntu3.1_powerpc.deb
          Size/MD5:  2112602 e73d8182c2cb1c4f5df66125f0a863eb
        http://ports.ubuntu.com/pool/main/d/dpkg/dselect_1.15.8.4ubuntu3.1_powerpc.deb
          Size/MD5:   516766 f09ea74971241c741312a7a2fe85a2b7
        http://ports.ubuntu.com/pool/main/d/dpkg/libdpkg-dev_1.15.8.4ubuntu3.1_powerpc.deb
          Size/MD5:   422710 79eb34bd5756074dc2d364e2db8b86a9
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":11.11,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"15","type":"x","order":"3","pct":33.33,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.