Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

  - Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to     cause a denial of service via a large block value in a cpio archive. (CVE-2014-9112)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

  - Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to     cause a denial of service via a large block value in a cpio archive. (CVE-2014-9112)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

A heap-based buffer overflow flaw was found in cpio's list_file() function. An attacker could provide a specially crafted archive that, when processed by cpio, would crash cpio, or potentially lead to arbitrary code execution. (CVE-2014-9112)

This update fixes the following bugs :

  - Previously, during archive creation, cpio internals did     not detect a read() system call failure. Based on the     premise that the call succeeded, cpio terminated     unexpectedly with a segmentation fault without     processing further files. The underlying source code has     been patched, and an archive is now created     successfully.

  - Previously, running the cpio command without parameters     on Scientific Linux 7 with Russian as the default     language resulted in an error message that was not     accurate in Russian due to an error in spelling. This     has been corrected and the Russian error message is     spelled correctly.

Updated cpio packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another.

A heap-based buffer overflow flaw was found in cpio's list_file() function. An attacker could provide a specially crafted archive that, when processed by cpio, would crash cpio, or potentially lead to arbitrary code execution. (CVE-2014-9112)

This update fixes the following bugs :

* Previously, during archive creation, cpio internals did not detect a read() system call failure. Based on the premise that the call succeeded, cpio terminated unexpectedly with a segmentation fault without processing further files. The underlying source code has been patched, and an archive is now created successfully. (BZ#1138148)

* Previously, running the cpio command without parameters on Red Hat Enterprise Linux 7 with Russian as the default language resulted in an error message that was not accurate in Russian due to an error in spelling. This has been corrected and the Russian error message is spelled correctly. (BZ#1075513)

All cpio users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2015:2108 :

Updated cpio packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The cpio packages provide the GNU cpio utility for creating and extracting archives, or copying files from one place to another.

A heap-based buffer overflow flaw was found in cpio's list_file() function. An attacker could provide a specially crafted archive that, when processed by cpio, would crash cpio, or potentially lead to arbitrary code execution. (CVE-2014-9112)

This update fixes the following bugs :

* Previously, during archive creation, cpio internals did not detect a read() system call failure. Based on the premise that the call succeeded, cpio terminated unexpectedly with a segmentation fault without processing further files. The underlying source code has been patched, and an archive is now created successfully. (BZ#1138148)

* Previously, running the cpio command without parameters on Red Hat Enterprise Linux 7 with Russian as the default language resulted in an error message that was not accurate in Russian due to an error in spelling. This has been corrected and the Russian error message is spelled correctly. (BZ#1075513)

All cpio users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

From the Debian Security Team :

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Updated cpio package fixes security vulnerabilities :

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive (CVE-2014-9112).

Additionally, a NULL pointer dereference in the copyin_link function which could cause a denial of service has also been fixed.

In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory.
However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1197).

Multiple issues have been identified in cpio, including a buffer overflow and multiple NULL pointer dereference, resulting at least in a denial of service and possibly also in an unwanted code execution.

This has been fixed in Debian 6 Squeeze with version 2.11-4+deb6u1 by applying the upstream patches.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201502-11 (GNU cpio: Multiple vulnerabilities)

    Two vulnerabilities have been discovered in GNU cpio:
      The list_file function in GNU cpio contains a heap-based buffer         overflow vulnerability (CVE-2014-9112)       A directory traversal vulnerability has been found in GNU cpio         (CVE-2015-1197)   Impact :

    A remote attacker may be able to entice a user to open a specially       crafted archive using GNU cpio, possibly resulting in execution of       arbitrary code, a Denial of Service condition, or overwriting arbitrary       files.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2456-1 advisory.

    Michal Zalewski discovered an out of bounds write issue in the process_copy_in function of GNU cpio. An     attacker could specially craft a cpio archive that could create a denial of service or possibly execute     arbitrary code. (CVE-2014-9112)

    Jakob Lell discovered a heap-based buffer overflow in the rmt_read__ function of GNU cpio's rmt client     functionality. An attacker controlling a remote rmt server could use this to cause a denial of service or     possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-0624)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2014-9112 (#1167573)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Michal Zalewski discovered an out of bounds write issue in cpio, a tool for creating and extracting cpio archive files. In the process of fixing that issue, the cpio developers found and fixed additional range checking and NULL pointer dereference issues.

This cpio update fixes the following security issue :

  - heap-based buffer overflow flaw in list_file()     (CVE-2014-9112). (bnc#907456)

This cpio update fixes the following secuirty issue :

  - fix an OOB write with cpio -i (bnc#907456)     (CVE-2014-9112)

Updated cpio package fixes security vulnerability :

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive (CVE-2014-9112).

Additionally, a NULL pointer dereference in the copyin_link function which could cause a denial of service has also been fixed.

ID	Name	Product	Family	Severity
198672	RHEL 5 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198601	RHEL 6 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
87552	Scientific Linux Security Update : cpio on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	medium
87130	CentOS 7 : cpio (CESA-2015:2108)	Nessus	CentOS Local Security Checks	medium
87021	Oracle Linux 7 : cpio (ELSA-2015-2108)	Nessus	Oracle Linux Local Security Checks	medium
86969	RHEL 7 : cpio (RHSA-2015:2108)	Nessus	Red Hat Local Security Checks	medium
82480	FreeBSD : cpio -- multiple vulnerabilities (72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8)	Nessus	FreeBSD Local Security Checks	medium
82318	Mandriva Linux Security Advisory : cpio (MDVSA-2015:065)	Nessus	Mandriva Local Security Checks	medium
82095	Debian DLA-111-1 : cpio security update	Nessus	Debian Local Security Checks	medium
81369	GLSA-201502-11 : GNU cpio: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
80441	Ubuntu 14.04 LTS : GNU cpio vulnerabilities (USN-2456-1)	Nessus	Ubuntu Local Security Checks	critical
80364	Fedora 20 : cpio-2.11-28.fc20 (2014-16250)	Nessus	Fedora Local Security Checks	medium
80284	Debian DSA-3111-1 : cpio - security update	Nessus	Debian Local Security Checks	medium
80165	SuSE 11.3 Security Update : cpio (SAT Patch Number 10070)	Nessus	SuSE Local Security Checks	medium
80089	Fedora 21 : cpio-2.11-33.fc21 (2014-16168)	Nessus	Fedora Local Security Checks	medium
80044	openSUSE Security Update : cpio (openSUSE-SU-2014:1643-1)	Nessus	SuSE Local Security Checks	medium
79995	Mandriva Linux Security Advisory : cpio (MDVSA-2014:250)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2014-9112

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium