CVE-2014-0471

What it actually does

Directory traversal vulnerability in the unpacking functionality allows remote attackers to write arbitrary files via a crafted source package using C-style filename quoting.

Why it matters to the business

Attackers can place files in unauthorized locations on Debian and Ubuntu systems, risking system integrity and potential compromise across widely deployed Linux distributions.

How an attack unfolds

An attacker crafts a malicious source package embedding directory traversal sequences through C-style quoted filenames; when a victim unpacks it with vulnerable dpkg, files are written outside the intended extraction directory.

How to fix it

Upgrade dpkg to 1.15.9 or newer, 1.16.13 or newer, or 1.17.8 or newer. Apply the listed tiff package fixes such as 4.0.6-3 on Debian 11/12/13 and 4.0.3-7ubuntu0.6 or 4.0.6-1ubuntu0.1 on Ubuntu 14.04/16.04 LTS.

How to confirm the fix worked

Confirm dpkg version meets or exceeds the fixed releases and verify package unpacking behaves as expected without traversal on test packages.

Typical attack path

1. Create source package with crafted filenames containing directory traversal via C-style quoting
2. Distribute the package to target systems or repositories
3. Victim performs package unpacking or installation with affected dpkg version
4. Arbitrary files written to unintended system paths enabling further access

How to detect it

Review dpkg logs and system file creation events during package operations for unexpected paths or files outside normal extraction directories.

What your security team should do

• Immediately apply dpkg and listed tiff package updates on all Debian and Ubuntu systems
• Audit package sources and avoid untrusted source packages until patched
• Monitor package management logs for anomalous file operations