Mandriva Linux Security Advisory : cpio (MDVSA-2010:065)

This script is Copyright (C) 2010-2013 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

A vulnerability has been found and corrected in cpio and tar :

Heap-based buffer overflow in the rmt_read__ function in
lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23
and GNU cpio before 2.11 allows remote rmt servers to cause a denial
of service (memory corruption) or possibly execute arbitrary code by
sending more data than was requested, related to archive filenames
that contain a : (colon) character (CVE-2010-0624).

The Tar package as shipped with Mandriva Linux is not affected by this
vulnerability, but it was patched nonetheless in order to provide
additional security to customers who recompile the package while
having the rsh package installed.

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.

The updated packages have been patched to correct this issue.

Solution :

Update the affected cpio and / or tar packages.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.9
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Mandriva Local Security Checks

Nessus Plugin ID: 45137 (mandriva_MDVSA-2010-065.nasl)

Bugtraq ID: 38628

CVE ID: CVE-2010-0624

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now