The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.

The remote host is affected by the vulnerability described in GLSA-202407-07 (cpio: Arbitrary Code Execution)

    Multiple vulnerabilities have been discovered in cpio. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

  - Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to     cause a denial of service via a large block value in a cpio archive. (CVE-2014-9112)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - cpio: directory traversal through symlinks (CVE-2015-1197)

  - cpio: out of bounds write (CVE-2016-2037)

  - Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to     cause a denial of service via a large block value in a cpio archive. (CVE-2014-9112)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the cpio package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of     service (out-of-bounds write) via a crafted cpio file. (CVE-2016-2037)

  - GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a     dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear     whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
    (CVE-2021-38185)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of     service (out-of-bounds write) via a crafted cpio file. (CVE-2016-2037)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The cpio_safer_name_suffix function in util.c in cpio     2.11 allows remote attackers to cause a denial of     service (out-of-bounds write) via a crafted cpio     file.(CVE-2016-2037)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cpio package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The cpio_safer_name_suffix function in util.c in cpio     2.11 allows remote attackers to cause a denial of     service (out-of-bounds write) via a crafted cpio     file.(CVE-2016-2037)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cpio package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The cpio_safer_name_suffix function in util.c in cpio     2.11 allows remote attackers to cause a denial of     service (out-of-bounds write) via a crafted cpio     file.(CVE-2016-2037)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sergey Poznyakoff reports :

This stable release fixes several potential vulnerabilities

CVE-2015-1197: cpio, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

CVE-2016-2037: The cpio_safer_name_suffix function in util.c allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.

CVE-2019-14866: Improper input validation when writing tar header fields leads to unexpected tar generation.

According to the versions of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GNU cpio copies files into or out of a cpio or tar     archive. Archives are files which contain a collection     of other files plus information about them, such as     their file name, owner, timestamps, and access     permissions. The archive can be another file on the     disk, a magnetic tape, or a pipe. GNU cpio supports the     following archive formats: binary, old ASCII, new     ASCII, crc, HPUX binary, HPUX old ASCII, old tar and     POSIX.1 tar. By default, cpio creates binary format     archives, so that they are compatible with older cpio     programs. When it is extracting files from archives,     cpio automatically recognizes which kind of archive it     is reading and can read archives created on machines     with a different byte-order.

  - Security Fix(es)

  - The cpio_safer_name_suffix function in util.c in cpio     2.11 allows remote attackers to cause a denial of     service (out-of-bounds write) via a crafted cpio     file.(CVE-2016-2037)

  - cpio 2.11, when using the --no-absolute-filenames     option, allows local users to write to arbitrary files     via a symlink attack on a file in an     archive.(CVE-2015-1197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cpio fixes two issues.

This security issue was fixed :

  - CVE-2016-2037: The cpio_safer_name_suffix function in     util.c in cpio allowed remote attackers to cause a     denial of service (out-of-bounds write) via a crafted     cpio file (bsc#963448).

This non-security issue was fixed :

  - bsc#1020108: Always use 32 bit CRC to prevent checksum     errors for files greater than 32MB

This update was imported from the SUSE:SLE-12:Update update project.

This update for cpio fixes two issues. This security issue was fixed :

  - CVE-2016-2037: The cpio_safer_name_suffix function in     util.c in cpio allowed remote attackers to cause a     denial of service (out-of-bounds write) via a crafted     cpio file (bsc#963448).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2906-1 advisory.

    Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic links when used with the --no-     absolute-filenames option. If a user or automated system were tricked into extracting a specially-crafted     cpio archive, a remote attacker could possibly use this issue to write arbitrary files. This issue only     affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-1197)

    Gustavo Grieco discovered that GNU cpio incorrectly handled memory when extracting archive files. If a     user or automated system were tricked into extracting a specially-crafted cpio archive, a remote attacker     could use this issue to cause GNU cpio to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-2037)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Gustavo Grieco discovered an out-of-bounds write vulnerability in cpio, a tool for creating and extracting cpio archive files, leading to a denial of service (application crash).

An out-of-bounds write was discovered in the parsing of cpio files.
For Debian 6 'Squeeze', this issue has been fixed in cpio version 2.11-4+deb6u2.

We recommend you to upgrade your cpio package.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
201185	GLSA-202407-07 : cpio: Arbitrary Code Execution	Nessus	Gentoo Local Security Checks	high
198672	RHEL 5 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198657	RHEL 7 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198601	RHEL 6 : cpio (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195416	RHEL 5 : cpio (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195396	RHEL 6 : cpio (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195351	RHEL 7 : cpio (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
158013	EulerOS Virtualization 3.0.6.6 : cpio (EulerOS-SA-2022-1114)	Nessus	Huawei Local Security Checks	high
156542	EulerOS Virtualization 3.0.2.6 : cpio (EulerOS-SA-2021-2911)	Nessus	Huawei Local Security Checks	high
156373	EulerOS Virtualization 3.0.2.0 : cpio (EulerOS-SA-2021-2819)	Nessus	Huawei Local Security Checks	high
155469	EulerOS 2.0 SP5 : cpio (EulerOS-SA-2021-2494)	Nessus	Huawei Local Security Checks	medium
154365	EulerOS 2.0 SP3 : cpio (EulerOS-SA-2021-2576)	Nessus	Huawei Local Security Checks	medium
153276	EulerOS 2.0 SP2 : cpio (EulerOS-SA-2021-2362)	Nessus	Huawei Local Security Checks	medium
147615	EulerOS Virtualization 2.9.1 : cpio (EulerOS-SA-2021-1593)	Nessus	Huawei Local Security Checks	medium
140951	EulerOS Virtualization for ARM 64 3.0.6.0 : cpio (EulerOS-SA-2020-2003)	Nessus	Huawei Local Security Checks	medium
139944	EulerOS 2.0 SP8 : cpio (EulerOS-SA-2020-1841)	Nessus	Huawei Local Security Checks	medium
131109	FreeBSD : GNU cpio -- multiple vulnerabilities (f59af308-07f3-11ea-8c56-f8b156b6dcc8)	Nessus	FreeBSD Local Security Checks	high
99804	EulerOS 2.0 SP1 : cpio (EulerOS-SA-2016-1041)	Nessus	Huawei Local Security Checks	medium
97006	openSUSE Security Update : cpio (openSUSE-2017-209)	Nessus	SuSE Local Security Checks	medium
96976	SUSE SLED12 / SLES12 Security Update : cpio (SUSE-SU-2017:0366-1)	Nessus	SuSE Local Security Checks	medium
88894	Ubuntu 14.04 LTS : GNU cpio vulnerabilities (USN-2906-1)	Nessus	Ubuntu Local Security Checks	medium
88866	Debian DSA-3483-1 : cpio - security update	Nessus	Debian Local Security Checks	medium
88740	Debian DLA-415-1 : cpio security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-2037

medium

Tenable Plugins

high

medium

medium

medium

high

high

high

high

high

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium