{"bulletinFamily": "unix", "hash": "5d9d60c26cf82709a4d65a76853e1d92364354fa0ae8d6157ce82db00d0f0c92", "id": "DSA-2011", "title": "dpkg -- path traversal", "enchantments": {"vulnersScore": 5.0}, "description": "William Grant discovered that the dpkg-source component of dpkg, the low-level infrastructure for handling the installation and removal of Debian software packages, is vulnerable to path traversal attacks. A specially crafted Debian source package can lead to file modification outside of the destination directory when extracting the package content.\n\nFor the stable distribution (lenny), this problem has been fixed in version 1.14.29.\n\nFor the testing (squeeze) and unstable (sid) distribution this problem will be fixed soon.\n\nWe recommend that you upgrade your dpkg packages.", "objectVersion": "1.2", "cvelist": ["CVE-2010-0396"], "viewCount": 0, "published": "2010-03-10T00:00:00", "href": "http://www.debian.org/security/dsa-2011", "references": [], "edition": 1, "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "reporter": "Debian", "history": [], "modified": "2010-03-10T00:00:00", "lastseen": "2016-09-02T18:35:58", "type": "debian", "affectedPackage": [{"arch": "x86-64", "packageFilename": "dpkg_1.14.29_amd64.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "arm", "packageFilename": "dselect_1.14.29_arm.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "s390x", "packageFilename": "dselect_1.14.29_s390.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "alpha", "packageFilename": "dselect_1.14.29_alpha.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "sparc", "packageFilename": "dpkg_1.14.29_sparc.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "src", "packageFilename": "dpkg_1.14.29.tar.gz", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "src", "packageFilename": "dpkg_1.14.29.dsc", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "arm", "packageFilename": "dpkg_1.14.29_arm.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "s390x", "packageFilename": "dpkg_1.14.29_s390.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "mipsel", "packageFilename": "dselect_1.14.29_mipsel.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "ppc", "packageFilename": "dpkg_1.14.29_powerpc.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "armel", "packageFilename": "dselect_1.14.29_armel.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "mipsel", "packageFilename": "dpkg_1.14.29_mipsel.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "hppa", "packageFilename": "dpkg_1.14.29_hppa.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "all", "packageFilename": "dpkg-dev_1.14.29_all.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg-dev", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "armel", "packageFilename": "dpkg_1.14.29_armel.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "ppc", "packageFilename": "dselect_1.14.29_powerpc.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "hppa", "packageFilename": "dselect_1.14.29_hppa.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "ia64", "packageFilename": "dselect_1.14.29_ia64.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "mips", "packageFilename": "dselect_1.14.29_mips.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "alpha", "packageFilename": "dpkg_1.14.29_alpha.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "i686", "packageFilename": "dselect_1.14.29_i386.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "mips", "packageFilename": "dpkg_1.14.29_mips.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "x86-64", "packageFilename": "dselect_1.14.29_amd64.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "i686", "packageFilename": "dpkg_1.14.29_i386.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "sparc", "packageFilename": "dselect_1.14.29_sparc.deb", "OSVersion": "5", "operator": "lt", "packageName": "dselect", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}, {"arch": "ia64", "packageFilename": "dpkg_1.14.29_ia64.deb", "OSVersion": "5", "operator": "lt", "packageName": "dpkg", "packageVersion": "1.14.29", "OS": "Debian GNU/Linux"}]}

{"result": {"cve": [{"id": "CVE-2010-0396", "type": "cve", "title": "CVE-2010-0396", "description": "Directory traversal vulnerability in the dpkg-source component in dpkg before 1.14.29 allows remote attackers to modify arbitrary files via a crafted Debian source archive.", "published": "2010-03-15T09:28:25", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0396", "cvelist": ["CVE-2010-0396"], "lastseen": "2017-08-17T11:14:42"}], "nessus": [{"id": "FEDORA_2010-4410.NASL", "type": "nessus", "title": "Fedora 13 : dpkg-1.15.5.6-4.fc13 (2010-4410)", "description": "This update fixes CVE-2010-0396 - dpkg path traversal issue * http://www.debian.org/security/2010/dsa-2011 * http://seclists.org/fulldisclosure/2010/Mar/201\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2010-07-01T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=47362", "cvelist": ["CVE-2010-0396"], "lastseen": "2017-10-29T13:44:24"}, {"id": "FEDORA_2010-4344.NASL", "type": "nessus", "title": "Fedora 11 : dpkg-1.15.5.6-4.fc11 (2010-4344)", "description": "This update fixes CVE-2010-0396 - dpkg path traversal issue * http://www.debian.org/security/2010/dsa-2011 * http://seclists.org/fulldisclosure/2010/Mar/201\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2010-07-01T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=47357", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-07-13T06:27:10"}, {"id": "DEBIAN_DSA-2011.NASL", "type": "nessus", "title": "Debian DSA-2011-1 : dpkg - path traversal", "description": "William Grant discovered that the dpkg-source component of dpkg, the low-level infrastructure for handling the installation and removal of Debian software packages, is vulnerable to path traversal attacks. A specially crafted Debian source package can lead to file modification outside of the destination directory when extracting the package content.", "published": "2010-03-11T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=45027", "cvelist": ["CVE-2010-0396"], "lastseen": "2017-10-29T13:41:02"}, {"id": "UBUNTU_USN-909-1.NASL", "type": "nessus", "title": "Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : dpkg vulnerability (USN-909-1)", "description": "William Grant discovered that dpkg-source did not safely apply diffs when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or potentially gaining access to the system.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2010-03-11T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=45038", "cvelist": ["CVE-2010-0396"], "lastseen": "2017-10-29T13:40:31"}, {"id": "FEDORA_2010-4371.NASL", "type": "nessus", "title": "Fedora 12 : dpkg-1.15.5.6-4.fc12 (2010-4371)", "description": "This update fixes CVE-2010-0396 - dpkg path traversal issue * http://www.debian.org/security/2010/dsa-2011 * http://seclists.org/fulldisclosure/2010/Mar/201\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2010-07-01T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=47359", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-07-13T06:00:22"}], "openvas": [{"id": "OPENVAS:136141256231067034", "type": "openvas", "title": "Debian Security Advisory DSA 2011-1 (dpkg)", "description": "The remote host is missing an update to dpkg\nannounced via advisory DSA 2011-1.", "published": "2010-03-16T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=136141256231067034", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-01-17T11:05:58"}, {"id": "OPENVAS:67034", "type": "openvas", "title": "Debian Security Advisory DSA 2011-1 (dpkg)", "description": "The remote host is missing an update to dpkg\nannounced via advisory DSA 2011-1.", "published": "2010-03-16T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=67034", "cvelist": ["CVE-2010-0396"], "lastseen": "2017-07-24T12:49:29"}, {"id": "OPENVAS:840398", "type": "openvas", "title": "Ubuntu Update for dpkg vulnerability USN-909-1", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-909-1", "published": "2010-03-12T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=840398", "cvelist": ["CVE-2010-0396"], "lastseen": "2017-12-04T11:18:17"}, {"id": "OPENVAS:861786", "type": "openvas", "title": "Fedora Update for dpkg FEDORA-2010-4371", "description": "Check for the Version of dpkg", "published": "2010-03-22T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=861786", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-01-02T10:54:34"}, {"id": "OPENVAS:1361412562310861789", "type": "openvas", "title": "Fedora Update for dpkg FEDORA-2010-4344", "description": "Check for the Version of dpkg", "published": "2010-03-22T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310861789", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-01-06T13:05:15"}, {"id": "OPENVAS:1361412562310840398", "type": "openvas", "title": "Ubuntu Update for dpkg vulnerability USN-909-1", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-909-1", "published": "2010-03-12T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310840398", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-01-18T11:05:15"}, {"id": "OPENVAS:861789", "type": "openvas", "title": "Fedora Update for dpkg FEDORA-2010-4344", "description": "Check for the Version of dpkg", "published": "2010-03-22T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=861789", "cvelist": ["CVE-2010-0396"], "lastseen": "2017-12-15T11:58:15"}, {"id": "OPENVAS:1361412562310861786", "type": "openvas", "title": "Fedora Update for dpkg FEDORA-2010-4371", "description": "Check for the Version of dpkg", "published": "2010-03-22T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310861786", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-01-26T11:05:48"}], "ubuntu": [{"id": "USN-909-1", "type": "ubuntu", "title": "dpkg vulnerability", "description": "William Grant discovered that dpkg-source did not safely apply diffs when unpacking source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or potentially gaining access to the system.", "published": "2010-03-11T00:00:00", "cvss": {"score": 5.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/909-1/", "cvelist": ["CVE-2010-0396"], "lastseen": "2018-03-29T18:20:38"}]}}