Oracle Linux 7 : cpio (ELSA-2015-2108)

This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote Oracle Linux host is missing a security update.

Description :

From Red Hat Security Advisory 2015:2108 :

Updated cpio packages that fix one security issue and two bugs are now
available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate
security impact. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The cpio packages provide the GNU cpio utility for creating and
extracting archives, or copying files from one place to another.

A heap-based buffer overflow flaw was found in cpio's list_file()
function. An attacker could provide a specially crafted archive that,
when processed by cpio, would crash cpio, or potentially lead to
arbitrary code execution. (CVE-2014-9112)

This update fixes the following bugs :

* Previously, during archive creation, cpio internals did not detect a
read() system call failure. Based on the premise that the call
succeeded, cpio terminated unexpectedly with a segmentation fault
without processing further files. The underlying source code has been
patched, and an archive is now created successfully. (BZ#1138148)

* Previously, running the cpio command without parameters on Red Hat
Enterprise Linux 7 with Russian as the default language resulted in an
error message that was not accurate in Russian due to an error in
spelling. This has been corrected and the Russian error message is
spelled correctly. (BZ#1075513)

All cpio users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

See also :

https://oss.oracle.com/pipermail/el-errata/2015-November/005553.html

Solution :

Update the affected cpio package.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 3.8
(CVSS2#E:U/RL:U/RC:UC)
Public Exploit Available : false

Family: Oracle Linux Local Security Checks

Nessus Plugin ID: 87021 ()

Bugtraq ID:

CVE ID: CVE-2014-9112

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now