sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [Fwd: cpio directory traversal vulnerability]

From: Thomas Houssin <thomas.houssin AT gmail.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [Fwd: cpio directory traversal vulnerability]
Date: Thu, 21 Apr 2005 01:27:05 +0200

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

--- Begin Message ---

From: Imran Ghory <imranghory AT gmail.com>

To: bugtraq AT securityfocus.com

Subject: cpio directory traversal vulnerability

Date: Wed, 20 Apr 2005 21:30:39 +0100

================================
cpio directory traversal vulnerability
================================

Software: cpio
Version: cpio 2.6
Software URL: <http://www.gnu.org/software/cpio/>
Platform: Unix, Linux.
Vulnerability type: Input validation
Severity: Medium, local vuln, Can result in privilege escalation.

Vulnerable software
====================

cpio 2.6 and previous versions running on unix.

Vulnerability
==============

There is a vulnerability in cpio that allows a malicious cpio file to
extract to an arbitrary directory of the attackers choice. cpio will
extract to the path specified in the cpio file, this path can be
absolute.

This vulnerability can be used to make the cpio file extract to a
directory which the attacker has write access to. This vulnerability
then be used in combination with the cpio TOCTOU file-permissions
vulnerability (CAN-2005-1111, Bugtraq #13159) to change the
permissions on arbitrary files belonging to the user.

Fix
========

None available at the present time.

--- End Message ---

Attachment: signature.asc
Description: OpenPGP digital signature

[SM-Security] [Fwd: cpio directory traversal vulnerability], Thomas Houssin, 04/20/2005