Ubuntu Security Notice 2183-2 - USN-2183-1 fixed a vulnerability in dpkg. Javier Serrano Polo discovered that the fix introduced a vulnerability in releases with an older version of the patch utility. This update fixes the problem. Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or potentially gaining access to the system. Various other issues were also addressed.
8637b20954031a4575400b91505f5fb816d51d9fe2097b94cbc136868f15bf68
============================================================================
Ubuntu Security Notice USN-2183-2
May 01, 2014
dpkg vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
A malicious source package could write files outside the unpack directory.
Software Description:
- dpkg: Debian package management system
Details:
USN-2183-1 fixed a vulnerability in dpkg. Javier Serrano Polo discovered
that the fix introduced a vulnerability in releases with an older version
of the patch utility. This update fixes the problem.
Original advisory details:
Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when
unpacking source packages. If a user or an automated system were tricked
into unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial of
service or potentially gaining access to the system.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libdpkg-perl 1.17.5ubuntu5.2
Ubuntu 13.10:
libdpkg-perl 1.16.12ubuntu1.2
Ubuntu 12.10:
libdpkg-perl 1.16.7ubuntu6.2
Ubuntu 12.04 LTS:
libdpkg-perl 1.16.1.2ubuntu7.4
Ubuntu 10.04 LTS:
dpkg-dev 1.15.5.6ubuntu4.8
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2183-2
http://www.ubuntu.com/usn/usn-2183-1
CVE-2014-0471
Package Information:
https://launchpad.net/ubuntu/+source/dpkg/1.17.5ubuntu5.2
https://launchpad.net/ubuntu/+source/dpkg/1.16.12ubuntu1.2
https://launchpad.net/ubuntu/+source/dpkg/1.16.7ubuntu6.2
https://launchpad.net/ubuntu/+source/dpkg/1.16.1.2ubuntu7.4
https://launchpad.net/ubuntu/+source/dpkg/1.15.5.6ubuntu4.8