Ubuntu 14.10: USN-2566-1 Critical: Dpkg Signature Bypass Exploit

ubuntu

April 9, 2015

dpkg could be tricked into bypassing source package signature checks.

Summary

dpkg could be tricked into bypassing source package signature checks.

Software Description:

- dpkg: Debian package management system

Details:

Jann Horn discovered that dpkg incorrectly validated signatures when

extracting local source packages. If a user or an automated system were

tricked into unpacking a specially crafted source package, a remote

attacker could bypass signature verification checks.

Topics Covered

security advisory update remote exploit Ubuntu vulnerability signature check dpkg

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libdpkg-perl                    1.17.13ubuntu1.1

Ubuntu 14.04 LTS:
  libdpkg-perl                    1.17.5ubuntu5.4

Ubuntu 12.04 LTS:
  libdpkg-perl                    1.16.1.2ubuntu7.6

Ubuntu 10.04 LTS:
  dpkg-dev                        1.15.5.6ubuntu4.10

In general, a standard system update will make all the necessary changes.