Security bugs are reported here via bugzilla

[Thomas Houssin <Thomas.Houssin AT gmail.com>]

Synopsis
========
cpio contains several vulnerabilities : a directory traversal
vulnerability (a crafted cpio archive could extract files to an
arbitrary directory) and a race condition (it could allow local users to
modify permissions of arbitrary files via a hard link attack on a file
while it is being decompressed).

Background
==========
GNU cpio - Creates cpio or tar archives and provides rmt

Description
===========
CAN-2005-1111:
Race condition in cpio 2.6 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it
is being decompressed, whose permissions are changed by cpio after the
decompression is complete.

CAN-2005-1229:
Directory traversal vulnerability in cpio 2.6 and earlier allows remote
attackers to write to arbitrary directories via a .. (dot dot) in a cpio
file.

Impact
======
An attacker could create a malicious cpio archive which would create
files in arbitrary locations on the victim's system. This issue could
also be used in conjunction with the race condition vulnerability to
change permissions on files owned by the victim.

Affected packages
=================
cpio in all grimoires (devel, test, stable-rc and stable) is affected.
This is now fixed in all grimoires.

Resolution
==========
All cpio users should upgrade to the latest available version:
        # scribe update
        # cast -c cpio

References
==========
  [ 1 ] CAN-2005-1111
        http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1111
  [ 2 ] CAN-2005-1229
        http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1229


-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature