A vulnerability has been identified in Debian, which could be exploited by attackers to bypass security restrictions. This issue is caused by an input validation error in the dpkg-source component of dpkg when extracting the content of a Debian source package, which could be exploited by attackers to manipulate files outside of the destination directory by tricking a user into extracting a malicious archive.

Affected Products

Debian GNU/Linux lenny
Debian GNU/Linux sid
Debian GNU/Linux squeeze

Solution

Debian GNU/Linux lenny - Upgrade to dpkg version 1.14.29
Debian GNU/Linux sid - A fix will be available soon
Debian GNU/Linux squeeze - A fix will be available soon

References

http://www.vupen.com/english/advisories/2010/0582
http://lists.debian.org/debian-security-announce/2010/msg00051.html

Credits

Vulnerability reported by William Grant.

Changelog

2010-03-11 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.