Ubuntu: 2084-1 Critical: Devscripts Remote Code Execution Issue

ubuntu

January 21, 2014

devscripts could be made to run programs if it opened a specially crafted file.

Summary

devscripts could be made to run programs if it opened a specially crafted

file.

Software Description:

- devscripts: scripts to make the life of a Debian Package maintainer easier

Details:

It was discovered that the uscan tool incorrectly repacked archive files.

If a user or automated system were tricked into processing specially

crafted files, a remote attacker could possibly execute arbitrary code.

Topics Covered

security advisory critical remote code execution Ubuntu software issue devscripts

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  devscripts                      2.13.4ubuntu0.1

Ubuntu 13.04:
  devscripts                      2.13.1ubuntu0.1

Ubuntu 12.10:
  devscripts                      2.12.4ubuntu0.1

Ubuntu 12.04 LTS:
  devscripts                      2.11.6ubuntu1.6

Ubuntu 10.04 LTS:
  devscripts                      2.10.61ubuntu5.6

In general, a standard system update will make all the necessary changes.