Directory Traversal Vulnerability in GNU Patch: CVE-2015-1396
Summary
CVE-2015-1396: A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. Affects patch versions < 2.7.3-1. Fixed in 2.7.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Patch is a widely used utility that allows users to apply changes to files and directories based on differences between them. It is essential for software development and maintenance, enabling developers to manage updates and modifications efficiently. However, prior to version 2.7.4, GNU Patch was susceptible to a Directory Traversal vulnerability, which could be exploited by attackers to manipulate files on the system.
Vulnerability Detail
The Directory Traversal vulnerability in GNU Patch (CVE-2015-1396) arises from an incomplete fix for a previous issue (CVE-2015-1196). This flaw allows a remote attacker to exploit symlink attacks within patch files, potentially leading to unauthorized writing to arbitrary files on the system. The ramifications of this vulnerability can be severe, as it may allow attackers to overwrite critical system files or inject malicious content, compromising the integrity and security of the affected system.
How To Fix
Minimum fixed version
2.7.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid applying patch files from untrusted sources or ensure that patch files do not contain symlinks. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The Directory Traversal vulnerability in GNU Patch (CVE-2015-1396) poses significant risks to system integrity and security. Users are strongly advised to upgrade to version 2.7.4 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for patch →
FAQ
CVE-2015-1396 is a Directory Traversal vulnerability in GNU Patch that allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The risks include unauthorized file modifications, potential system compromise, and the ability for attackers to inject malicious content into critical files.
GNU Patch versions prior to 2.7.4 are affected by this vulnerability.
Yes, you can avoid applying patch files from untrusted sources or ensure that patch files do not contain symlinks as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for patch.
