Bug 350877 (CVE-2010-1679) – sys-devel/patch, <app-arch/dpkg-1.15.8.8: directory traversal flaw allows for arbitrary file creation (CVE-2010-{1679,4651})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Paweł Hajdan, Jr. (RETIRED) 2011-01-06 20:12:02 UTC]

Jakub Wilk discovered that the dpkg-source component of dpkg, the Debian
package management system, doesn't correctly handle paths in patches of
source packages, which could make it traverse directories.
Raphaël Hertzog additionally discovered that symbolic links in the .pc
directory are followed, which could make it traverse directories too.

Both issues only affect source packages using the "3.0 quilt" format at
unpack-time.

http://lists.debian.org/debian-security-announce/2011/msg00004.html
https://bugzilla.redhat.com/show_bug.cgi?id=667529

I suggest rating this B2.

[Comment 1 Jeroen Roovers (RETIRED) 2011-01-06 22:25:26 UTC]

Changes: 
 dpkg (1.15.8.8) unstable; urgency=low
 .
   [ Guillem Jover ]
   * Truncate the output part file on “dpkg-split -s”. Regression introduced
     with the C rewrite.
 .
   [ Updated man page translations ]
   * Two typos fixed in French (Christian Perrier, thanks to Julien
     Valroff).
 .
   [ Raphaël Hertzog ]
   * Fix multiple security issues with dpkg-source (CVE-2010-1679):
     - Enhance checks to catch maliciously crafted patches which could modify
       files outside of the unpacked source package.
     - Do not consider a top-level symlink like a directory when
       extracting a tarball.
     - Exclude .pc while extracting the upstream tarball in 3.0 (quilt)
       as patch blindly writes in that directory during unpack (and would
       follow any existing symlink).

[Comment 2 Tim Sammut (RETIRED) 2011-01-07 06:03:53 UTC]

(In reply to comment #0)
> 
> I suggest rating this B2.
> 

Agreed. Feel free to set the status whiteboard going forward; someone will ping you if they disagree. ;) 

I believe CVE-2010-1679 is for dpkg, and according to http://www.openwall.com/lists/oss-security/2011/01/06/20, CVE-2010-4651 is for patch.

[Comment 3 Jeroen Roovers (RETIRED) 2011-01-07 15:47:47 UTC]

Arch teams, please test and mark stable:
=app-arch/dpkg-1.15.8.8
Target KEYWORDS="alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"

Sadly there was a new unkeyworded src_test() dependency for alpha arm hppa ia64 ppc ppc64 and sparc:
dev-perl/DateTime-Format-DateParse

Either mark that and its dependencies stable or mask the app-arch/dpkg[test] USE flag in your profiles.

[Comment 4 Agostino Sarubbo 2011-01-07 16:17:12 UTC]

amd64 ok

[Comment 5 Markos Chandras (RETIRED) 2011-01-07 17:52:24 UTC]

amd64 done. Thanks Agostino

[Comment 6 Christian Faulhammer (RETIRED) 2011-01-07 23:44:35 UTC]

x86 stable

[Comment 7 Kacper Kowalik (Xarthisius) (RETIRED) 2011-01-08 09:44:41 UTC]

ppc/ppc64 stable

[Comment 8 Jeroen Roovers (RETIRED) 2011-01-08 18:57:53 UTC]

Stable for HPPA. I think ARM and ALPHA are good too:

# ChangeLog for app-arch/dpkg
# Copyright 1999-2011 Gentoo Foundation; Distributed under the GPL v2
# $Header: /var/cvsroot/gentoo-x86/app-arch/dpkg/ChangeLog,v 1.149 2011/01/08 18:55:28 jer Exp $

  08 Jan 2011; Jeroen Roovers <[e-mail]> dpkg-1.15.8.8.ebuild:
  Stable for HPPA (bug #350877).

  08 Jan 2011; Raúl Porcel <[e-mail]> dpkg-1.15.8.8.ebuild:
  alpha/arm/ia64/s390/sh/sparc stable wrt #350877

[Comment 9 Raúl Porcel (RETIRED) 2011-01-08 19:55:07 UTC]

alpha/arm/ia64/m68k/s390/sh/sparc stable

[Comment 10 Tim Sammut (RETIRED) 2011-01-11 01:00:56 UTC]

A fixed app-arch/dpkg has been stabilized, but we are waiting on a fixed version of sys-devel/patch.Updating the status whiteboard to show that.

[Comment 11 Tim Sammut (RETIRED) 2011-02-01 13:48:05 UTC]

The Red Hat bug (https://bugzilla.redhat.com/show_bug.cgi?id=667529) now contains a patch for patch at https://bugzilla.redhat.com/attachment.cgi?id=476365.

[Comment 12 Paweł Hajdan, Jr. (RETIRED) 2011-02-04 21:04:12 UTC]

sys-devel/patch upstream commit: http://git.savannah.gnu.org/cgit/patch.git/commit/?id=685a78b6052f4df6eac6d625a545cfb54a6ac0e1

[Comment 13 SpanKY 2011-02-10 20:58:36 UTC]

unfortunately, they keep finding bugs in the new behavior, so i'm not really comfortable adding any patches to patch right now.

[Comment 14 Chris Reffett (RETIRED) 2013-09-03 18:36:25 UTC]

@maintainers: is there a fixed version in tree for patch now?

[Comment 15 SpanKY 2013-12-25 08:56:09 UTC]

(In reply to Chris Reffett from comment #14)

i don't believe upstream has merged a fix for the issue

[Comment 16 Chris Reffett (RETIRED) 2014-06-15 00:10:04 UTC]

By sec team decision, no GLSA for dpkg. Still waiting on patch.

[Comment 17 Yury German 2015-12-31 06:20:14 UTC]

The affected version has been out of tree for a while.
Thank you all. Closing as noglsa.