Skip to Content.
Sympa Menu

sm-security - [SM-Security] cpio: several vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <Thomas.Houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] cpio: several vulnerabilities
  • Date: Mon, 27 Jun 2005 22:00:52 +0200

Synopsis
========
cpio contains several vulnerabilities : a directory traversal
vulnerability (a crafted cpio archive could extract files to an
arbitrary directory) and a race condition (it could allow local users to
modify permissions of arbitrary files via a hard link attack on a file
while it is being decompressed).

Background
==========
GNU cpio - Creates cpio or tar archives and provides rmt

Description
===========
CAN-2005-1111:
Race condition in cpio 2.6 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it
is being decompressed, whose permissions are changed by cpio after the
decompression is complete.

CAN-2005-1229:
Directory traversal vulnerability in cpio 2.6 and earlier allows remote
attackers to write to arbitrary directories via a .. (dot dot) in a cpio
file.

Impact
======
An attacker could create a malicious cpio archive which would create
files in arbitrary locations on the victim's system. This issue could
also be used in conjunction with the race condition vulnerability to
change permissions on files owned by the victim.

Affected packages
=================
cpio in all grimoires (devel, test, stable-rc and stable) is affected.
This is now fixed in all grimoires.

Resolution
==========
All cpio users should upgrade to the latest available version:
# scribe update
# cast -c cpio

References
==========
[ 1 ] CAN-2005-1111
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1111
[ 2 ] CAN-2005-1229
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1229


--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] cpio: several vulnerabilities, Thomas Houssin, 06/27/2005

Archive powered by MHonArc 2.6.24.

Top of Page