CVE-2015-8768

What it actually does

The vulnerability permits a crafted tarball package to place files outside the intended directory because click/install.py does not enforce that all paths begin with ./, allowing an alternate security policy to be installed and privileges to be escalated.

Why it matters to the business

Attackers can obtain elevated access on affected systems, enabling unauthorized policy changes and potential full compromise of devices that rely on the click packaging mechanism.

How an attack unfolds

An attacker creates a malicious package tarball containing files without the required ./ prefix, distributes the package (for example as the demonstrated test.mmrow app), and the victim system installs it; the missing path restriction causes the alternate security policy to be written to the system, granting the attacker elevated privileges.

How to fix it

Upgrade click to a version that enforces the ./ prefix requirement on all tarball members; where fixed packages are supplied, apply the updates listed for each distribution (for example ntp packages on Debian 11 and Ubuntu 16.04/14.04 as applicable).

How to confirm the fix worked

Confirm the installed click package version matches or exceeds the corrected release for the distribution; test installation of a package containing a non-./ path and verify the operation is rejected.

Typical attack path

1. Craft a tarball whose members do not start with ./
2. Host or deliver the malicious package to a target system
3. Trick or cause the target to invoke click install on the package
4. The installed policy overrides existing security controls
5. Attacker obtains elevated privileges on the device

How to detect it

Review click package installation logs and system policy directories for files installed from packages whose paths do not begin with ./; look for unexpected security policy files added outside normal package locations.

What your security team should do

• Apply the vendor-supplied fixed versions immediately
• Restrict installation of untrusted click packages until patched
• Monitor package installation logs for unexpected policy changes