Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. (dot dot) in a cpio file.

Buffer overflow in the safer_name_suffix function in GNU cpio has unspecified attack vectors and impact, resulting in a crashing stack.
This problem is originally found in tar, but affects cpio too, due to similar code fragments. (CVE-2007-4476)

Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. (dot dot) in a cpio file. This is an old issue, affecting only Mandriva Corporate Server 4 and Mandriva Linux 2007. (CVE-2005-1229)

Updated package fixes these issues.

Imran Ghory found a race condition in the handling of output files.
While a file was unpacked with cpio, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the cpio user. (CAN-2005-1111)

Imran Ghory discovered a path traversal vulnerability. Even when the
--no-absolute-filenames option was specified, cpio did not filter out '..' path components. By tricking an user into unpacking a malicious cpio archive, this could be exploited to install files in arbitrary paths with the privileges of the user calling cpio. (CAN-2005-1229).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been discovered in cpio, a program to manage archives of files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-1111     Imran Ghory discovered a race condition in setting the     file permissions of files extracted from cpio archives.
    A local attacker with write access to the target     directory could exploit this to alter the permissions of     arbitrary files the extracting user has write     permissions for.

  - CAN-2005-1229

    Imran Ghory discovered that cpio does not sanitise the     path of extracted files even if the
    --no-absolute-filenames option was specified. This can     be exploited to install files in arbitrary locations     where the extracting user has write permissions to.

A race condition has been found in cpio 2.6 and earlier which allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete (CVE-2005-1111).

A vulnerability has been discovered in cpio that allows a malicious cpio file to extract to an arbitrary directory of the attackers choice. cpio will extract to the path specified in the cpio file, this path can be absolute (CVE-2005-1229).

Update :

The previous packages had a problem upgrading due to an unresolved issue with tar and rmt. These packages correct the problem.

ID	Name	Product	Family	Severity
28352	Mandrake Linux Security Advisory : cpio (MDKSA-2007:233)	Nessus	Mandriva Local Security Checks	high
20601	Ubuntu 4.10 / 5.04 : cpio vulnerabilities (USN-189-1)	Nessus	Ubuntu Local Security Checks	medium
19954	Debian DSA-846-1 : cpio - several vulnerabilities	Nessus	Debian Local Security Checks	medium
18678	Mandrake Linux Security Advisory : cpio (MDKSA-2005:116-1)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2005-1229

high

Tenable Plugins

high

medium

medium

medium