Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.

An updated cpio package that fixes multiple issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A race condition bug was found in cpio. It is possible for a local malicious user to modify the permissions of a local file if they have write access to a directory in which a cpio archive is being extracted. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1111 to this issue.

Additionally, this update adds cpio support for archives larger than 2GB. However, the size of individual files within an archive is limited to 4GB.

All users of cpio are advised to upgrade to this updated package, which contains backported fixes for these issues.

Imran Ghory found a race condition in the handling of output files.
While a file was unpacked with cpio, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the cpio user. (CAN-2005-1111)

Imran Ghory discovered a path traversal vulnerability. Even when the
--no-absolute-filenames option was specified, cpio did not filter out '..' path components. By tricking an user into unpacking a malicious cpio archive, this could be exploited to install files in arbitrary paths with the privileges of the user calling cpio. (CAN-2005-1229).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated cpio package that fixes multiple issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A race condition bug was found in cpio. It is possible for a local malicious user to modify the permissions of a local file if they have write access to a directory in which a cpio archive is being extracted. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1111 to this issue.

It was discovered that cpio uses a 0 umask when creating files using the -O (archive) option. This creates output files with mode 0666 (all users can read and write) regardless of the user's umask setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-1572 to this issue.

All users of cpio are advised to upgrade to this updated package, which contains backported fixes for these issues.

Two vulnerabilities have been discovered in cpio, a program to manage archives of files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-1111     Imran Ghory discovered a race condition in setting the     file permissions of files extracted from cpio archives.
    A local attacker with write access to the target     directory could exploit this to alter the permissions of     arbitrary files the extracting user has write     permissions for.

  - CAN-2005-1229

    Imran Ghory discovered that cpio does not sanitise the     path of extracted files even if the
    --no-absolute-filenames option was specified. This can     be exploited to install files in arbitrary locations     where the extracting user has write permissions to.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:378 advisory.

    GNU cpio copies files into or out of a cpio or tar archive.

    A race condition bug was found in cpio. It is possible for a local     malicious user to modify the permissions of a local file if they have write     access to a directory in which a cpio archive is being extracted. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-1111 to this issue.

    Additionally, this update adds cpio support for archives larger than 2GB.
    However, the size of individual files within an archive is limited to 4GB.

    All users of cpio are advised to upgrade to this updated package, which     contains backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A race condition has been found in cpio 2.6 and earlier which allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete (CVE-2005-1111).

A vulnerability has been discovered in cpio that allows a malicious cpio file to extract to an arbitrary directory of the attackers choice. cpio will extract to the path specified in the cpio file, this path can be absolute (CVE-2005-1229).

Update :

The previous packages had a problem upgrading due to an unresolved issue with tar and rmt. These packages correct the problem.

The remote host is affected by the vulnerability described in GLSA-200506-16 (cpio: Directory traversal vulnerability)

    A vulnerability has been found in cpio that can potentially allow     a cpio archive to extract its files to an arbitrary directory of the     creator's choice.
  Impact :

    An attacker could create a malicious cpio archive which would     create files in arbitrary locations on the victim's system. This issue     could also be used in conjunction with a previous race condition     vulnerability (CAN-2005-1111) to change permissions on files owned by     the victim.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
21815	CentOS 3 / 4 : cpio (CESA-2005:378)	Nessus	CentOS Local Security Checks	low
20601	Ubuntu 4.10 / 5.04 : cpio vulnerabilities (USN-189-1)	Nessus	Ubuntu Local Security Checks	medium
20204	RHEL 2.1 : cpio (RHSA-2005:806)	Nessus	Red Hat Local Security Checks	low
19954	Debian DSA-846-1 : cpio - several vulnerabilities	Nessus	Debian Local Security Checks	medium
19283	RHEL 4 : cpio (RHSA-2005:378)	Nessus	Red Hat Local Security Checks	medium
18678	Mandrake Linux Security Advisory : cpio (MDKSA-2005:116-1)	Nessus	Mandriva Local Security Checks	medium
18531	GLSA-200506-16 : cpio: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2005-1111

medium

Tenable Plugins

low

medium

low

medium

medium

medium

low