debian Debian/Ubuntu Linux: Find If Installed APT Package Includes a Fix/Patch Via CVE Number
Article Number: 373 | Rating: Unrated | Last Updated: Sun, Sep 23, 2018 11:13 AM
I am a Debian Linux server user. How do I view the changelog of an installed package and find out if given CVE includes a fix or patch? How do I see a fix or patch already applied to installed package on a Ubuntu or Debian LTS server?
The changelog of an installed package is usaully stored as follows on a Debian or Ubuntu or Mint Linux:
- Directory: /usr/share/doc/$PackageNameHere/
- Changelog file name: changelog.Debian.gz
You can use the less or zgrep command to view /usr/share/doc/<PackageNameHere>/changelog.Debian.gz file.
Syntax
You need to replace <PackageNameHere> with the actual package name:
less /usr/share/doc/<PackageNameHere>/changelog.Debian.gz zgrep 'cve-number-here' /usr/share/doc/<PackageNameHere>/changelog.Debian.gz
Examples: Find lighttpd package change log
In this example view info about a package called lighttpd, enter:
less /usr/share/doc/lighttpd/changelog.Debian.gz |
Sample outputs:
Example: See if lighttpd package includes a fix/patch for cve # cve-2013-4559
To find out if installed package called lighttpd includes a fix or patch, enter:
$ zgrep -i cve-2013-4559 /usr/share/doc/lighttpd/changelog.Debian.gz * Fix cve-2013-4559: setuid privilege escalation issue.
To display all cve, enter:
$ zgrep -i cve /usr/share/doc/lighttpd/changelog.Debian.gz
* Fix regression caused by the fix for cve-2013-4508 (closes: #729480).
* Fix cve-2013-4508: ssl cipher suites issue.
* Fix cve-2013-4559: setuid privilege escalation issue.
* Fix cve-2013-4560: use-after-free in fam.
* CVE-2013-1427: Switch the socket path for PHP when using FastCGI. /tmp is
- CVE-2013-1427: Switch the socket path for PHP when using FASTCGI. /tmp
Say hello to debsecan
debsecan analyzes the list of installed packages on the current host and reports vulnerabilities found on the system.
Installation
Use the apt command/apt-get command to install it:
$ sudo apt install debsecan
Sample outputs:
Reading package lists... Done Building dependency tree Reading state information... Done The following additional packages will be installed: exim4 exim4-base exim4-config exim4-daemon-light s-nail Suggested packages: eximon4 exim4-doc-html | exim4-doc-info spf-tools-perl swaks The following NEW packages will be installed: debsecan exim4 exim4-base exim4-config exim4-daemon-light s-nail 0 upgraded, 6 newly installed, 0 to remove and 0 not upgraded. Need to get 2,026 kB of archives. After this operation, 4,653 kB of additional disk space will be used. Do you want to continue? [Y/n] y Get:1 http://mirrors.digitalocean.com/ubuntu xenial/universe amd64 debsecan all 0.4.18 [33.9 kB] Get:2 http://mirrors.digitalocean.com/ubuntu xenial-updates/main amd64 exim4-config all 4.86.2-2ubuntu2.2 [298 kB] Get:3 http://mirrors.digitalocean.com/ubuntu xenial-updates/main amd64 exim4-base amd64 4.86.2-2ubuntu2.2 [869 kB] Get:4 http://mirrors.digitalocean.com/ubuntu xenial-updates/main amd64 exim4-daemon-light amd64 4.86.2-2ubuntu2.2 [465 kB] Get:5 http://mirrors.digitalocean.com/ubuntu xenial-updates/main amd64 exim4 all 4.86.2-2ubuntu2.2 [7,904 B] Get:6 http://mirrors.digitalocean.com/ubuntu xenial/universe amd64 s-nail amd64 14.8.6-1 [353 kB] Fetched 2,026 kB in 0s (2,406 kB/s) Preconfiguring packages ... Selecting previously unselected package debsecan. (Reading database ... 144268 files and directories currently installed.) Preparing to unpack .../debsecan_0.4.18_all.deb ... Unpacking debsecan (0.4.18) ... Selecting previously unselected package exim4-config. Preparing to unpack .../exim4-config_4.86.2-2ubuntu2.2_all.deb ... Unpacking exim4-config (4.86.2-2ubuntu2.2) ... Selecting previously unselected package exim4-base. Preparing to unpack .../exim4-base_4.86.2-2ubuntu2.2_amd64.deb ... Unpacking exim4-base (4.86.2-2ubuntu2.2) ... Selecting previously unselected package exim4-daemon-light. Preparing to unpack .../exim4-daemon-light_4.86.2-2ubuntu2.2_amd64.deb ... Unpacking exim4-daemon-light (4.86.2-2ubuntu2.2) ... Selecting previously unselected package exim4. Preparing to unpack .../exim4_4.86.2-2ubuntu2.2_all.deb ... Unpacking exim4 (4.86.2-2ubuntu2.2) ... Selecting previously unselected package s-nail. Preparing to unpack .../s-nail_14.8.6-1_amd64.deb ... Unpacking s-nail (14.8.6-1) ... Processing triggers for man-db (2.7.5-1) ... Processing triggers for systemd (229-4ubuntu17) ... Processing triggers for ureadahead (0.100.0-19) ... Setting up debsecan (0.4.18) ... Setting up exim4-config (4.86.2-2ubuntu2.2) ... Adding system-user for exim (v4) Setting up exim4-base (4.86.2-2ubuntu2.2) ... exim: DB upgrade, deleting hints-db Setting up exim4-daemon-light (4.86.2-2ubuntu2.2) ... Setting up exim4 (4.86.2-2ubuntu2.2) ... Setting up s-nail (14.8.6-1) ... update-alternatives: using /usr/bin/s-nail to provide /usr/bin/mailx (mailx) in auto mode Processing triggers for systemd (229-4ubuntu17) ... Processing triggers for ureadahead (0.100.0-19) ...
Usage
Just run it as follows:
$ debsecan | more
Sample outputs:
CVE-2016-2775 bind9-host (remotely exploitable, medium urgency) CVE-2016-2776 bind9-host (remotely exploitable, high urgency) CVE-2016-6170 bind9-host (remotely exploitable, medium urgency) CVE-2016-8864 bind9-host (remotely exploitable, medium urgency) CVE-2016-9131 bind9-host (remotely exploitable, medium urgency) CVE-2016-9147 bind9-host (remotely exploitable, medium urgency) CVE-2016-9444 bind9-host (remotely exploitable, medium urgency) CVE-2017-3135 bind9-host CVE-2017-3136 bind9-host CVE-2017-3137 bind9-host CVE-2017-3138 bind9-host CVE-2016-9243 python3-cryptography (remotely exploitable, medium urgency) CVE-2016-1248 vim-tiny (remotely exploitable, medium urgency) CVE-2017-5953 vim-tiny (remotely exploitable, high urgency) CVE-2017-6349 vim-tiny (remotely exploitable, high urgency) CVE-2017-6350 vim-tiny (remotely exploitable, high urgency) CVE-2015-1331 liblxc1 (medium urgency) CVE-2015-1334 liblxc1 (medium urgency) CVE-2015-1335 liblxc1 (high urgency) CVE-2016-10124 liblxc1 (remotely exploitable, medium urgency) CVE-2016-8649 liblxc1 (remotely exploitable, high urgency) ... .. ... CVE-2016-10228 locales (remotely exploitable, medium urgency) CVE-2016-6323 locales (remotely exploitable, medium urgency) CVE-2017-1000366 locales CVE-2017-8804 locales (remotely exploitable, high urgency) CVE-2017-6507 libapparmor-perl (remotely exploitable, medium urgency) CVE-2016-2324 git (remotely exploitable, high urgency) CVE-2017-8386 git (remotely exploitable, medium urgency) CVE-2017-6594 libheimntlm0-heimdal CVE-2016-7942 libx11-data (remotely exploitable, high urgency) CVE-2016-7943 libx11-data (remotely exploitable, high urgency) CVE-2015-8948 libidn11 (remotely exploitable, medium urgency) CVE-2016-6261 libidn11 (remotely exploitable, medium urgency) CVE-2016-6263 libidn11 (remotely exploitable, medium urgency) CVE-2016-1233 fuse (high urgency) CVE-2016-2568 libpolkit-gobject-1-0 (medium urgency) TEMP-0000000-4DA0A8 libdbus-1-3 CVE-2016-2779 util-linux (high urgency) CVE-2016-5011 util-linux (medium urgency) CVE-2017-6964 eject (high urgency) CVE-2016-2779 libsmartcols1 (high urgency) CVE-2016-5011 libsmartcols1 (medium urgency)
You can use the grep command to search for any package name or CVE as follows:
$ debsecan | grep -i openvpn
Sample outputs:
CVE-2017-7478 openvpn (remotely exploitable, medium urgency) CVE-2017-7479 openvpn (remotely exploitable, medium urgency) CVE-2017-7508 openvpn CVE-2017-7520 openvpn CVE-2017-7521 openvpn
Or search for CVE-2017-1000364
$ debsecan | grep -i CVE-2017-1000364
Sample outputs:
CVE-2017-1000364 linux-image-4.4.0-79-generic CVE-2017-1000364 linux-headers-4.4.0-79 CVE-2017-1000364 linux-headers-4.4.0-79-generic CVE-2017-1000364 linux-headers-4.4.0-81-generic CVE-2017-1000364 linux-headers-4.4.0-78 CVE-2017-1000364 linux-headers-4.4.0-81 CVE-2017-1000364 linux-headers-4.4.0-78-generic CVE-2017-1000364 linux-headers-4.4.0-63 CVE-2017-1000364 linux-image-4.4.0-78-generic CVE-2017-1000364 linux-headers-4.4.0-63-generic CVE-2017-1000364 linux-image-4.4.0-63-generic CVE-2017-1000364 linux-image-4.4.0-81-generic
A note about Debian security tracker
You can always use web based security tracker located at the following url:
Subscribe to Article
Print Article
Email Article to Friend
Export to PDF
Export to MS Word