Directory Traversal Vulnerability in GNU Patch Package
Summary
DEBIAN-CVE-2015-1396: A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. Affects patch versions < 2.7.3-1. Fixed in 2.7.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GNU Patch package is a widely used utility that allows users to apply changes to files and directories based on a patch file. It is essential for developers and system administrators who need to manage source code changes efficiently. However, certain versions of this package are vulnerable to a Directory Traversal attack, which can lead to unauthorized file access and modifications.
Vulnerability Detail
A Directory Traversal vulnerability exists in the GNU patch before version 2.7.4. This vulnerability allows a remote attacker to exploit a symlink attack in a patch file, enabling them to write to arbitrary files on the system. The issue arises from an incomplete fix for CVE-2015-1196, making it critical for users to address this vulnerability to prevent potential data breaches and system compromises.
How To Fix
Minimum fixed version
2.7.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid applying patch files from untrusted sources and ensure that proper file permissions are set to limit access to sensitive files.
Conclusion
The Directory Traversal vulnerability in the GNU Patch package poses a significant risk to systems using affected versions. It is crucial for users to update to the patched version to safeguard their systems against potential attacks. By following the recommended steps and utilizing tools like Vulert, users can effectively monitor and manage vulnerabilities in their software.
See every vulnerability recorded for patch →
FAQ
A Directory Traversal vulnerability allows an attacker to access files and directories that are outside the intended directory structure, potentially leading to unauthorized access to sensitive data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any installation.
Failing to fix this vulnerability could allow attackers to manipulate files on your system, leading to data loss, corruption, or unauthorized access to sensitive information.
Yes, you can mitigate the risk by avoiding the use of untrusted patch files and ensuring that your file permissions are properly configured to restrict access.
More information can be found in the official CVE database and security advisories related to the GNU Patch package.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
