Vulnerability Details : CVE-2014-3227
dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.
Vulnerability category: Directory traversal
Exploit prediction scoring system (EPSS) score for CVE-2014-3227
Probability of exploitation activity in the next 30 days: 0.46%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 72 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-3227
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:P |
10.0
|
4.9
|
NIST |
CWE ids for CVE-2014-3227
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3227
-
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746306
#746306 - dpkg: CVE-2014-0471 fix introduces the vulnerability into squeeze - Debian Bug report logs
-
http://openwall.com/lists/oss-security/2014/05/29/16
oss-security - Re: CVE request: another path traversal in dpkg-source during unpack
-
http://openwall.com/lists/oss-security/2014/04/29/4
oss-security - CVE request: directory traversal in DSA-2915-1-patched dpkg in Debian squeeze
Products affected by CVE-2014-3227
- cpe:2.3:a:debian:dpkg:1.17.4:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.2:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.0:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.8:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.6:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.2:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.0:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.12:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.11:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.10:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.9:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.7:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.6:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.5:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.4:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.3:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.1:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.7:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.5:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.16.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.17.8:*:*:*:*:*:*:*
- cpe:2.3:a:debian:dpkg:1.15.9:*:*:*:*:*:*:*