Buffer overflow in cpio 2.6-8.FC4 on 64-bit platforms, when creating a cpio archive, allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a file whose size is represented by more than 8 digits.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - GNU cpio
  - GNU cpio on 64-bit
  - GNU tar
  - Kerberos 5
  - Perl
  - PostgreSQL
  - Safe Module for Perl Automagic Methods
  - Samba smbd

From Red Hat Security Advisory 2010:0145 :

An updated cpio package that fixes two security issues is now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

Red Hat would like to thank Jakob Lell for responsibly reporting the CVE-2010-0624 issue.

A stack-based buffer overflow flaw was found in the way cpio expanded large archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. This issue only affected 64-bit platforms. (CVE-2005-4268)

Users of cpio are advised to upgrade to this updated package, which contains backported patches to correct these issues.

From Red Hat Security Advisory 2007:0245 :

An updated cpio package that fixes a security issue and various bugs is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A buffer overflow was found in cpio on 64-bit platforms. By tricking a user into adding a specially crafted large file to a cpio archive, a local attacker may be able to exploit this flaw to execute arbitrary code with the target user's privileges. (CVE-2005-4268)

This erratum also addresses the following bugs :

* cpio did not set exit codes appropriately.

* cpio did not create a ram disk properly.

All users of cpio are advised to upgrade to this updated package, which contains backported fixes to correct these issues.

An updated cpio package that fixes a security issue and various bugs is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A buffer overflow was found in cpio on 64-bit platforms. By tricking a user into adding a specially crafted large file to a cpio archive, a local attacker may be able to exploit this flaw to execute arbitrary code with the target user's privileges. (CVE-2005-4268)

This erratum also addresses the following bugs :

* cpio did not set exit codes appropriately.

* cpio did not create a ram disk properly.

All users of cpio are advised to upgrade to this updated package, which contains backported fixes to correct these issues.

CVE-2005-4268 cpio large filesize buffer overflow

CVE-2007-4476 tar/cpio stack crashing in safer_name_suffix

CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

A stack-based buffer overflow flaw was found in the way cpio expanded large archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. This issue only affected 64-bit platforms. (CVE-2005-4268) - SL3 Only

A denial of service flaw was found in the way cpio expanded archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. (CVE-2007-4476) - SL5 Only

A buffer overflow was found in cpio on 64-bit platforms. By tricking a user into adding a specially crafted large file to a cpio archive, a local attacker may be able to exploit this flaw to execute arbitrary code with the target user's privileges. (CVE-2005-4268)

a. Service Console update for cpio

   The service console package cpio is updated to version 2.5-6.RHEL3    for ESX 3.x versions and updated to version 2.6-23.el5_4.1 for    ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2005-4268 and CVE-2010-0624 to the issues    addressed in the update for ESX 3.x and the names CVE-2007-4476 and    CVE-2010-0624 to the issues addressed in the update for ESX 4.x.

b. Service Console update for tar

   The service console package tar is updated to version    1.13.25-16.RHEL3 for ESX 3.x versions and updated to version    1.15.1-23.0.1.el5_4.2 for ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0624 to the issue addressed in the    update for ESX 3.x and the names CVE-2007-4476 and CVE-2010-0624    to the issues addressed in the update for ESX 4.x.

c. Service Console update for samba

   The service console packages for samba are updated to version    samba-3.0.9-1.3E.17vmw, samba-client-3.0.9-1.3E.17vmw and    samba-common-3.0.9-1.3E.17vmw.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2063 to the issue addressed in this    update.

   Note :
   The issue mentioned above is present in the Samba server (smbd) and    is not present in the Samba client or Samba common packages.

   To determine if your system has Samba server installed do a    'rpm -q samba`.

   The following lists when the Samba server is installed on the ESX    service console :

   - ESX 4.0, ESX 4.1      The Samba server is not present on ESX 4.0 and ESX 4.1.

   - ESX 3.5      The Samba server is present if an earlier patch for Samba has been      installed.

   - ESX 3.0.3      The Samba server is present if ESX 3.0.3 was upgraded from an      earlier version of ESX 3 and a Samba patch was installed on that      version.

   The Samba server is not needed to operate the service console and    can be be disabled without loss of functionality to the service    console.

d. Service Console update for krb5

   The service console package krb5 is updated to version 1.2.7-72    for ESX 3.x versions and to version 1.6.1-36.el5_5.4 for ESX 4.x    versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-1321 to the issue addressed in    these updates.

e. Service Console update for perl

   The service console package perl is updated to version    5.8.0-101.EL3 for ESX 3.x versions and version 5.8.8-32.el5_5.1    for ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1168 and CVE-2010-1447 to the issues    addressed in the update for ESX 3.x and the names CVE-2008-5302,    CVE-2008-5303, CVE-2010-1168, and CVE-2010-1447 to the issues    addressed in the update for ESX 4.x.

An updated cpio package that fixes two security issues is now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

Red Hat would like to thank Jakob Lell for responsibly reporting the CVE-2010-0624 issue.

A stack-based buffer overflow flaw was found in the way cpio expanded large archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. This issue only affected 64-bit platforms. (CVE-2005-4268)

Users of cpio are advised to upgrade to this updated package, which contains backported patches to correct these issues.

Richard Harms discovered that cpio did not sufficiently validate file properties when creating archives. Files with e. g. a very large size caused a buffer overflow. By tricking a user or an automatic backup system into putting a specially crafted file into a cpio archive, a local attacker could probably exploit this to execute arbitrary code with the privileges of the target user (which is likely root in an automatic backup system).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in cpio 2.6 on 64-bit platforms could allow a local user to create a DoS (crash) and possibly execute arbitrary code when creating a cpio archive with a file whose size is represented by more than 8 digits.

The updated packages have been patched to correct these problems.

ID	Name	Product	Family	Severity
89741	VMware ESX Multiple Vulnerabilities (VMSA-2010-0013) (remote check)	Nessus	VMware ESX Local Security Checks	high
68012	Oracle Linux 3 : cpio (ELSA-2010-0145)	Nessus	Oracle Linux Local Security Checks	medium
67479	Oracle Linux 4 : cpio (ELSA-2007-0245)	Nessus	Oracle Linux Local Security Checks	low
67045	CentOS 4 : cpio (CESA-2007:0245)	Nessus	CentOS Local Security Checks	low
60745	Scientific Linux Security Update : cpio on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60163	Scientific Linux Security Update : cpio on on SL4 i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
49085	VMSA-2010-0013 : VMware ESX third-party updates for Service Console	Nessus	VMware ESX Local Security Checks	high
46268	RHEL 3 : cpio (RHSA-2010:0145)	Nessus	Red Hat Local Security Checks	medium
45090	CentOS 3 : cpio (CESA-2010:0145)	Nessus	CentOS Local Security Checks	medium
25141	RHEL 4 : cpio (RHSA-2007:0245)	Nessus	Red Hat Local Security Checks	low
20778	Ubuntu 4.10 / 5.04 / 5.10 : cpio vulnerability (USN-234-1)	Nessus	Ubuntu Local Security Checks	low
20468	Mandrake Linux Security Advisory : cpio (MDKSA-2005:237)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2005-4268

critical

Tenable Plugins

high

medium

low

low

high

low

high

medium

medium

low

low

low