|
|
Family: Ubuntu Local Security Checks --> Category: infos
USN189-1 : cpio vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
cpio vulnerabilities
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote package "cpio" is missing a security patch.
Description :
Imran Ghory found a race condition in the handling of output files.
While a file was unpacked with cpio, a local attacker with write
permissions to the target directory could exploit this to change the
permissions of arbitrary files of the cpio user. (CVE-2005-1111)
Imran Ghory discovered a path traversal vulnerability. Even when the
--no-absolute-filenames option was specified, cpio did not filter out
".." path components. By tricking an user into unpacking a malicious
cpio archive, this could be exploited to install files in arbitrary
paths with the rights of the user calling cpio. (CVE-2005-1229)
Solution :
Upgrade to :
- cpio-2.5-1.1ubuntu1.1 (Ubuntu 5.04)
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
