RHEL 7 : cpio (RHSA-2015:2108)

This script is Copyright (C) 2015-2017 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated cpio packages that fix one security issue and two bugs are now
available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The cpio packages provide the GNU cpio utility for creating and
extracting archives, or copying files from one place to another.

A heap-based buffer overflow flaw was found in cpio's list_file()
function. An attacker could provide a specially crafted archive that,
when processed by cpio, would crash cpio, or potentially lead to
arbitrary code execution. (CVE-2014-9112)

This update fixes the following bugs :

* Previously, during archive creation, cpio internals did not detect a
read() system call failure. Based on the premise that the call
succeeded, cpio terminated unexpectedly with a segmentation fault
without processing further files. The underlying source code has been
patched, and an archive is now created successfully. (BZ#1138148)

* Previously, running the cpio command without parameters on Red Hat
Enterprise Linux 7 with Russian as the default language resulted in an
error message that was not accurate in Russian due to an error in
spelling. This has been corrected and the Russian error message is
spelled correctly. (BZ#1075513)

All cpio users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

See also :

https://www.redhat.com/security/data/cve/CVE-2014-9112.html
http://rhn.redhat.com/errata/RHSA-2015-2108.html

Solution :

Update the affected cpio and / or cpio-debuginfo packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 3.8
(CVSS2#E:U/RL:U/RC:UC)
Public Exploit Available : false

Family: Red Hat Local Security Checks

Nessus Plugin ID: 86969 ()

Bugtraq ID:

CVE ID: CVE-2014-9112

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now