Ubuntu 14.04 LTS: USN-2242-1 Critical: Dpkg Unauthorized File Access

ubuntu

June 10, 2014

A malicious source package could write files outside the unpack directory.

Summary

A malicious source package could write files outside the unpack directory.

Software Description:

- dpkg: Debian package management system

Details:

It was discovered that dpkg incorrectly handled certain patches when

unpacking source packages. If a user or an automated system were tricked

into unpacking a specially crafted source package, a remote attacker could

modify files outside the target unpack directory, leading to a denial of

service or potentially gaining access to the system.

Topics Covered

security advisory unauthorized access critical ubuntu dpkg file modification

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libdpkg-perl                    1.17.5ubuntu5.3

Ubuntu 13.10:
  libdpkg-perl                    1.16.12ubuntu1.3

Ubuntu 12.04 LTS:
  libdpkg-perl                    1.16.1.2ubuntu7.5

Ubuntu 10.04 LTS:
  dpkg-dev                        1.15.5.6ubuntu4.9

In general, a standard system update will make all the necessary changes.