Ubuntu 14.04 LTS USN-2183-1 Critical Dpkg File Access Attack

ubuntu

April 28, 2014

A malicious source package could write files outside the unpack directory.

Summary

A malicious source package could write files outside the unpack directory.

Software Description:

- dpkg: Debian package management system

Details:

Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when

unpacking source packages. If a user or an automated system were tricked

into unpacking a specially crafted source package, a remote attacker could

modify files outside the target unpack directory, leading to a denial of

service or potentially gaining access to the system.

Topics Covered

security advisory denial of service critical remote access file access ubuntu dpkg issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libdpkg-perl                    1.17.5ubuntu5.1

Ubuntu 13.10:
  libdpkg-perl                    1.16.12ubuntu1.1

Ubuntu 12.10:
  libdpkg-perl                    1.16.7ubuntu6.1

Ubuntu 12.04 LTS:
  libdpkg-perl                    1.16.1.2ubuntu7.3

Ubuntu 10.04 LTS:
  dpkg-dev                        1.15.5.6ubuntu4.7

In general, a standard system update will make all the necessary changes.