|
|
Family: Ubuntu Local Security Checks --> Category: infos
USN234-1 : cpio vulnerability Vulnerability Scan
Vulnerability Scan Summary
cpio vulnerability
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote package "cpio" is missing a security patch.
Description :
Richard Harms discovered that cpio did not sufficiently validate file
properties when creating archives. Files with e. g. a very large size
caused a buffer overflow. By tricking a user or an automatic backup
system into putting a specially crafted file into a cpio archive, a
local attacker could probably exploit this to execute arbitrary code
with the rights of the target user (which is likely root in an
automatic backup system).
Solution :
Upgrade to :
- cpio-2.5-1.2ubuntu1.1 (Ubuntu 5.10)
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
