cpio security update

2005-07-2119:16:30

CentOS Project

lists.centos.org

CVSS2

3.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:P/I:P/A:P

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

Percentile

15.7%

JSON

CentOS Errata and Security Advisory CESA-2005:378

GNU cpio copies files into or out of a cpio or tar archive.

A race condition bug was found in cpio. It is possible for a local
malicious user to modify the permissions of a local file if they have write
access to a directory in which a cpio archive is being extracted. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-1111 to this issue.

Additionally, this update adds cpio support for archives larger than 2GB.
However, the size of individual files within an archive is limited to 4GB.

All users of cpio are advised to upgrade to this updated package, which
contains backported fixes for these issues.

Affected packages:
cpio

Upstream details at:
https://access.redhat.com/errata/RHSA-2005:378

OSVersionArchitecturePackageVersionFilename
CentOS3ia64cpio< 2.5-4.RHEL3cpio-2.5-4.RHEL3.ia64.rpm
CentOS3s390cpio< 2.5-4.RHEL3cpio-2.5-4.RHEL3.s390.rpm
CentOS3s390xcpio< 2.5-4.RHEL3cpio-2.5-4.RHEL3.s390x.rpm
CentOS4ia64cpio< 2.5-8.RHEL4cpio-2.5-8.RHEL4.ia64.rpm
CentOS3i386cpio< 2.5-4.RHEL3cpio-2.5-4.RHEL3.i386.rpm
CentOS3x86_64cpio< 2.5-4.RHEL3cpio-2.5-4.RHEL3.x86_64.rpm
CentOS3i386cpio< 2.5-4.RHEL3cpio-2.5-4.RHEL3.i386.rpm
CentOS3x86_64cpio< 2.5-4.RHEL3cpio-2.5-4.RHEL3.x86_64.rpm
CentOS4x86_64cpio< 2.5-8.RHEL4cpio-2.5-8.RHEL4.x86_64.rpm
CentOS4i386cpio< 2.5-8.RHEL4cpio-2.5-8.RHEL4.i386.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	ia64	cpio	< 2.5-4.RHEL3	cpio-2.5-4.RHEL3.ia64.rpm
CentOS	3	s390	cpio	< 2.5-4.RHEL3	cpio-2.5-4.RHEL3.s390.rpm
CentOS	3	s390x	cpio	< 2.5-4.RHEL3	cpio-2.5-4.RHEL3.s390x.rpm
CentOS	4	ia64	cpio	< 2.5-8.RHEL4	cpio-2.5-8.RHEL4.ia64.rpm
CentOS	3	i386	cpio	< 2.5-4.RHEL3	cpio-2.5-4.RHEL3.i386.rpm
CentOS	3	x86_64	cpio	< 2.5-4.RHEL3	cpio-2.5-4.RHEL3.x86_64.rpm
CentOS	3	i386	cpio	< 2.5-4.RHEL3	cpio-2.5-4.RHEL3.i386.rpm
CentOS	3	x86_64	cpio	< 2.5-4.RHEL3	cpio-2.5-4.RHEL3.x86_64.rpm
CentOS	4	x86_64	cpio	< 2.5-8.RHEL4	cpio-2.5-8.RHEL4.x86_64.rpm
CentOS	4	i386	cpio	< 2.5-8.RHEL4	cpio-2.5-8.RHEL4.i386.rpm