CVE-2014-1833

What it actually does

Directory traversal vulnerability in uupdate allows remote attackers to modify arbitrary files via crafted .orig.tar files that exploit symlinks during extraction or processing.

Why it matters to the business

Attackers can alter arbitrary files on affected database server systems, leading to potential configuration tampering, data corruption, or unauthorized access that disrupts operations and requires urgent patching across Ubuntu environments.

How an attack unfolds

An attacker supplies a malicious .orig.tar archive containing symlinks to a process using the vulnerable devscripts uupdate utility; the symlink traversal causes writes to arbitrary filesystem locations outside the intended directory.

How to fix it

Upgrade mariadb-5.5 (Ubuntu 14.04 LTS) to 5.5.46-1ubuntu0.14.04.2, mysql-5.6 (Ubuntu 14.04 LTS) to 5.6.27-0ubuntu0.14.04.1, and mariadb-10.0 (Ubuntu 16.04 LTS) to 10.0.22-0ubuntu1 or later equivalents; remove or isolate vulnerable devscripts versions until updates are applied.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed releases using dpkg or apt; test uupdate behavior against known symlink-containing test archives to verify traversal is blocked.

Typical attack path

1. Craft a malicious .orig.tar file embedding symlinks pointing outside the extraction root
2. Deliver the archive to a system processing it with vulnerable devscripts uupdate
3. Trigger archive handling that follows symlinks during extraction or update
4. Arbitrary files are overwritten or modified on the target system

How to detect it

Review system and package manager logs for invocations of uupdate or devscripts handling .orig.tar files; inspect recent file modification timestamps and ownership changes on sensitive paths that could result from symlink traversal.

• uupdate
• .orig.tar
• symlink traversal in tar extraction

What your security team should do

• Immediately apply the listed package updates to all affected Ubuntu systems
• Scan for and review any unexpected file modifications around timestamps of .orig.tar processing
• Restrict untrusted archive sources from being fed into devscripts utilities