cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

  - Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to     cause a denial of service via a large block value in a cpio archive. (CVE-2014-9112)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: path traversal vulnerability (CVE-2023-7207)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

  - Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to     cause a denial of service via a large block value in a cpio archive. (CVE-2014-9112)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the cpio package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files     via a symlink attack on a file in an archive. (CVE-2015-1197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-557 advisory.

    cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files     via a symlink attack on a file in an archive. (CVE-2015-1197)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cpio installed on the remote host is prior to 2.12-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2489 advisory.

    cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files     via a symlink attack on a file in an archive. (CVE-2015-1197)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cpio installed on the remote host is prior to 2.10-12.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1925 advisory.

    cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files     via a symlink attack on a file in an archive. (CVE-2015-1197)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files     via a symlink attack on a file in an archive. (CVE-2015-1197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cpio package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - cpio 2.11, when using the --no-absolute-filenames     option, allows local users to write to arbitrary files     via a symlink attack on a file in an     archive.(CVE-2015-1197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sergey Poznyakoff reports :

This stable release fixes several potential vulnerabilities

CVE-2015-1197: cpio, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

CVE-2016-2037: The cpio_safer_name_suffix function in util.c allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.

CVE-2019-14866: Improper input validation when writing tar header fields leads to unexpected tar generation.

According to the versions of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GNU cpio copies files into or out of a cpio or tar     archive. Archives are files which contain a collection     of other files plus information about them, such as     their file name, owner, timestamps, and access     permissions. The archive can be another file on the     disk, a magnetic tape, or a pipe. GNU cpio supports the     following archive formats: binary, old ASCII, new     ASCII, crc, HPUX binary, HPUX old ASCII, old tar and     POSIX.1 tar. By default, cpio creates binary format     archives, so that they are compatible with older cpio     programs. When it is extracting files from archives,     cpio automatically recognizes which kind of archive it     is reading and can read archives created on machines     with a different byte-order.

  - Security Fix(es)

  - The cpio_safer_name_suffix function in util.c in cpio     2.11 allows remote attackers to cause a denial of     service (out-of-bounds write) via a crafted cpio     file.(CVE-2016-2037)

  - cpio 2.11, when using the --no-absolute-filenames     option, allows local users to write to arbitrary files     via a symlink attack on a file in an     archive.(CVE-2015-1197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2906-1 advisory.

    Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic links when used with the --no-     absolute-filenames option. If a user or automated system were tricked into extracting a specially-crafted     cpio archive, a remote attacker could possibly use this issue to write arbitrary files. This issue only     affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-1197)

    Gustavo Grieco discovered that GNU cpio incorrectly handled memory when extracting archive files. If a     user or automated system were tricked into extracting a specially-crafted cpio archive, a remote attacker     could use this issue to cause GNU cpio to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-2037)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From the Debian Security Team :

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

Updated cpio package fixes security vulnerability :

In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory.
However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1197).

Updated cpio package fixes security vulnerabilities :

Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive (CVE-2014-9112).

Additionally, a NULL pointer dereference in the copyin_link function which could cause a denial of service has also been fixed.

In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory.
However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1197).

The remote host is affected by the vulnerability described in GLSA-201502-11 (GNU cpio: Multiple vulnerabilities)

    Two vulnerabilities have been discovered in GNU cpio:
      The list_file function in GNU cpio contains a heap-based buffer         overflow vulnerability (CVE-2014-9112)       A directory traversal vulnerability has been found in GNU cpio         (CVE-2015-1197)   Impact :

    A remote attacker may be able to entice a user to open a specially       crafted archive using GNU cpio, possibly resulting in execution of       arbitrary code, a Denial of Service condition, or overwriting arbitrary       files.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
198672	RHEL 5 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198662	RHEL 9 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198657	RHEL 7 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198601	RHEL 6 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
192363	EulerOS Virtualization 2.11.0 : cpio (EulerOS-SA-2024-1425)	Nessus	Huawei Local Security Checks	high
192345	EulerOS Virtualization 2.11.1 : cpio (EulerOS-SA-2024-1397)	Nessus	Huawei Local Security Checks	high
191597	Amazon Linux 2023 : cpio (ALAS2023-2024-557)	Nessus	Amazon Linux Local Security Checks	high
191522	Amazon Linux 2 : cpio (ALAS-2024-2489)	Nessus	Amazon Linux Local Security Checks	high
191517	Amazon Linux AMI : cpio (ALAS-2024-1925)	Nessus	Amazon Linux Local Security Checks	high
188612	EulerOS Virtualization 2.10.1 : cpio (EulerOS-SA-2023-3491)	Nessus	Huawei Local Security Checks	medium
188495	EulerOS 2.0 SP11 : cpio (EulerOS-SA-2023-3265)	Nessus	Huawei Local Security Checks	medium
188418	EulerOS Virtualization 2.10.0 : cpio (EulerOS-SA-2023-3463)	Nessus	Huawei Local Security Checks	medium
188387	EulerOS 2.0 SP10 : cpio (EulerOS-SA-2023-3167)	Nessus	Huawei Local Security Checks	medium
188338	EulerOS 2.0 SP11 : cpio (EulerOS-SA-2023-3237)	Nessus	Huawei Local Security Checks	medium
188126	EulerOS 2.0 SP10 : cpio (EulerOS-SA-2023-3202)	Nessus	Huawei Local Security Checks	medium
140332	EulerOS Virtualization for ARM 64 3.0.2.0 : cpio (EulerOS-SA-2020-1962)	Nessus	Huawei Local Security Checks	low
131109	FreeBSD : GNU cpio -- multiple vulnerabilities (f59af308-07f3-11ea-8c56-f8b156b6dcc8)	Nessus	FreeBSD Local Security Checks	high
99804	EulerOS 2.0 SP1 : cpio (EulerOS-SA-2016-1041)	Nessus	Huawei Local Security Checks	medium
88894	Ubuntu 14.04 LTS : GNU cpio vulnerabilities (USN-2906-1)	Nessus	Ubuntu Local Security Checks	medium
82480	FreeBSD : cpio -- multiple vulnerabilities (72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8)	Nessus	FreeBSD Local Security Checks	medium
82319	Mandriva Linux Security Advisory : cpio (MDVSA-2015:066)	Nessus	Mandriva Local Security Checks	low
82318	Mandriva Linux Security Advisory : cpio (MDVSA-2015:065)	Nessus	Mandriva Local Security Checks	medium
81369	GLSA-201502-11 : GNU cpio: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2015-1197

high

Tenable Plugins

medium

medium

medium

medium

high

high

high

high

high

medium

medium

medium

medium

medium

medium

low

high

medium

medium

medium

low

medium

medium