Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New dpkg packages fix path traversal |
| Informations | |||
|---|---|---|---|
| Name | DSA-2011 | First vendor Publication | 2010-03-10 |
| Vendor | Debian | Last vendor Modification | 2010-03-10 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5.8 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| William Grant discovered that the dpkg-source component of dpkg, the low-level infrastructure for handling the installation and removal of Debian software packages, is vulnerable to path traversal attacks. A specially crafted Debian source package can lead to file modification outside of the destination directory when extracting the package content. For the stable distribution (lenny), this problem has been fixed in version 1.14.29. For the testing (squeeze) and unstable (sid) distribution this problem will be fixed soon. We recommend that you upgrade your dpkg packages. |
Original Source
| Url : http://www.debian.org/security/2010/dsa-2011 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12698 | |||
| Oval ID: | oval:org.mitre.oval:def:12698 | ||
| Title: | USN-909-1 -- dpkg vulnerability | ||
| Description: | William Grant discovered that dpkg-source did not safely apply diffs when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or potentially gaining access to the system. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-909-1 CVE-2010-0396 | Version: | 7 |
| Platform(s): | Ubuntu 8.04 Ubuntu 8.10 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04 | Product(s): | dpkg |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13418 | |||
| Oval ID: | oval:org.mitre.oval:def:13418 | ||
| Title: | DSA-2011-1 dpkg -- path traversal | ||
| Description: | William Grant discovered that the dpkg-source component of dpkg, the low-level infrastructure for handling the installation and removal of Debian software packages, is vulnerable to path traversal attacks. A specially crafted Debian source package can lead to file modification outside of the destination directory when extracting the package content. For the stable distribution, this problem has been fixed in version 1.14.29. For the testing and unstable distribution this problem will be fixed soon. We recommend that you upgrade your dpkg packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2011-1 CVE-2010-0396 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | dpkg |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:6917 | |||
| Oval ID: | oval:org.mitre.oval:def:6917 | ||
| Title: | DSA-2011 dpkg -- path traversal | ||
| Description: | William Grant discovered that the dpkg-source component of dpkg, the low-level infrastructure for handling the installation and removal of Debian software packages, is vulnerable to path traversal attacks. A specially crafted Debian source package can lead to file modification outside of the destination directory when extracting the package content. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2011 CVE-2010-0396 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | dpkg |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-03-22 | Name : Fedora Update for dpkg FEDORA-2010-4344 File : nvt/gb_fedora_2010_4344_dpkg_fc11.nasl |
| 2010-03-22 | Name : Fedora Update for dpkg FEDORA-2010-4371 File : nvt/gb_fedora_2010_4371_dpkg_fc12.nasl |
| 2010-03-16 | Name : Debian Security Advisory DSA 2011-1 (dpkg) File : nvt/deb_2011_1.nasl |
| 2010-03-12 | Name : Ubuntu Update for dpkg vulnerability USN-909-1 File : nvt/gb_ubuntu_USN_909_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 62856 | Debian dpkg dpkg-source Unspecified Directory Traversal |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-4344.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-4371.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-4410.nasl - Type : ACT_GATHER_INFO |
| 2010-03-11 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2011.nasl - Type : ACT_GATHER_INFO |
| 2010-03-11 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-909-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:29:17 |
|
