Description
click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://ubuntu.com/usn/usn-2771-1 ↗
- http://www.securityfocus.com/bid/96386 ↗
- http://bazaar.launchpad.net/~click-hackers/click/devel/revision/587 ↗
- https://bugs.launchpad.net/ubuntu/+source/click/+bug/1506467 ↗
- https://insights.ubuntu.com/2015/10/15/update-on-ubuntu-phone-security-issue/ ↗
- https://code.launchpad.net/~cjwatson/click/audit-missing-dot-slash/+merge/274554 ↗
- http://www.openwall.com/lists/oss-security/2016/01/12/8 ↗
- https://plus.google.com/+SzymonWaliczek/posts/3jbG2uiAniF ↗