CVE-2014-3127 Path traversal in n/a
Remote attackers can modify files outside intended directories via crafted source packages due to a path traversal vulnerability in dpkg.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2014-3127?
CVE-2014-3127 is a high-severity path traversal vulnerability in n/a, published on 14 May 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.
Weakness: CWE-22
Which versions are affected by CVE-2014-3127?
It affects 1 product.
Products include Debian Dpkg.
How do I fix CVE-2014-3127?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-3127 being exploited?
There is no known exploitation of CVE-2014-3127 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2014-3127, GHSA-f267-j9wx-cwjf, UBUNTU-CVE-2014-3127.