Ubuntu 14.04 LTS USN-2183-2 Moderate: Dpkg Denial Of Service

ubuntu

May 1, 2014

A malicious source package could write files outside the unpack directory.

Summary

A malicious source package could write files outside the unpack directory.

Software Description:

- dpkg: Debian package management system

Details:

USN-2183-1 fixed a vulnerability in dpkg. Javier Serrano Polo discovered

that the fix introduced a vulnerability in releases with an older version

of the patch utility. This update fixes the problem.

Original advisory details:

Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when

unpacking source packages. If a user or an automated system were tricked

into unpacking a specially crafted source package, a remote attacker could

modify files outside the target unpack directory, leading to a denial of

service or potentially gaining access to the system.

Topics Covered

security advisory denial of service ubuntu system access dpkg malicious package

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libdpkg-perl                    1.17.5ubuntu5.2

Ubuntu 13.10:
  libdpkg-perl                    1.16.12ubuntu1.2

Ubuntu 12.10:
  libdpkg-perl                    1.16.7ubuntu6.2

Ubuntu 12.04 LTS:
  libdpkg-perl                    1.16.1.2ubuntu7.4

Ubuntu 10.04 LTS:
  dpkg-dev                        1.15.5.6ubuntu4.8

In general, a standard system update will make all the necessary changes.