Vulnerabilities > CVE-2015-1197 - Unspecified vulnerability in GNU Cpio 2.11
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN gnu
nessus
Summary
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Nessus
NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-2906-1.NASL description Alexander Cherepanov discovered that GNU cpio incorrectly handled symbolic links when used with the --no-absolute-filenames option. If a user or automated system were tricked into extracting a specially crafted cpio archive, a remote attacker could possibly use this issue to write arbitrary files. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-1197) Gustavo Grieco discovered that GNU cpio incorrectly handled memory when extracting archive files. If a user or automated system were tricked into extracting a specially crafted cpio archive, a remote attacker could use this issue to cause GNU cpio to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-2037). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 88894 published 2016-02-23 reporter Ubuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/88894 title Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : cpio vulnerabilities (USN-2906-1) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_F59AF30807F311EA8C56F8B156B6DCC8.NASL description Sergey Poznyakoff reports : This stable release fixes several potential vulnerabilities CVE-2015-1197: cpio, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. CVE-2016-2037: The cpio_safer_name_suffix function in util.c allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file. CVE-2019-14866: Improper input validation when writing tar header fields leads to unexpected tar generation. last seen 2020-06-01 modified 2020-06-02 plugin id 131109 published 2019-11-18 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/131109 title FreeBSD : GNU cpio -- multiple vulnerabilities (f59af308-07f3-11ea-8c56-f8b156b6dcc8) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-065.NASL description Updated cpio package fixes security vulnerabilities : Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive (CVE-2014-9112). Additionally, a NULL pointer dereference in the copyin_link function which could cause a denial of service has also been fixed. In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1197). last seen 2020-06-01 modified 2020-06-02 plugin id 82318 published 2015-03-30 reporter This script is Copyright (C) 2015-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82318 title Mandriva Linux Security Advisory : cpio (MDVSA-2015:065) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201502-11.NASL description The remote host is affected by the vulnerability described in GLSA-201502-11 (GNU cpio: Multiple vulnerabilities) Two vulnerabilities have been discovered in GNU cpio: The list_file function in GNU cpio contains a heap-based buffer overflow vulnerability (CVE-2014-9112) A directory traversal vulnerability has been found in GNU cpio (CVE-2015-1197) Impact : A remote attacker may be able to entice a user to open a specially crafted archive using GNU cpio, possibly resulting in execution of arbitrary code, a Denial of Service condition, or overwriting arbitrary files. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 81369 published 2015-02-16 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81369 title GLSA-201502-11 : GNU cpio: Multiple vulnerabilities NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-066.NASL description Updated cpio package fixes security vulnerability : In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write files outside the current directory (CVE-2015-1197). last seen 2020-06-01 modified 2020-06-02 plugin id 82319 published 2015-03-30 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82319 title Mandriva Linux Security Advisory : cpio (MDVSA-2015:066) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_72EE9707D7B211E48D8EF8B156B6DCC8.NASL description From the Debian Security Team : Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. last seen 2020-06-01 modified 2020-06-02 plugin id 82480 published 2015-04-01 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/82480 title FreeBSD : cpio -- multiple vulnerabilities (72ee9707-d7b2-11e4-8d8e-f8b156b6dcc8) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2016-1041.NASL description According to the versions of the cpio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GNU cpio copies files into or out of a cpio or tar archive. Archives are files which contain a collection of other files plus information about them, such as their file name, owner, timestamps, and access permissions. The archive can be another file on the disk, a magnetic tape, or a pipe. GNU cpio supports the following archive formats: binary, old ASCII, new ASCII, crc, HPUX binary, HPUX old ASCII, old tar and POSIX.1 tar. By default, cpio creates binary format archives, so that they are compatible with older cpio programs. When it is extracting files from archives, cpio automatically recognizes which kind of archive it is reading and can read archives created on machines with a different byte-order. - Security Fix(es) - The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.(CVE-2016-2037) - cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.(CVE-2015-1197) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-05-06 modified 2017-05-01 plugin id 99804 published 2017-05-01 reporter This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/99804 title EulerOS 2.0 SP1 : cpio (EulerOS-SA-2016-1041)
References
- http://www.securityfocus.com/bid/71914
- http://www.openwall.com/lists/oss-security/2015/01/07/5
- https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669
- http://www.openwall.com/lists/oss-security/2015/01/18/7
- http://advisories.mageia.org/MGASA-2015-0080.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:066
- http://www.ubuntu.com/usn/USN-2906-1
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
- http://www.openwall.com/lists/oss-security/2023/12/21/8
- http://www.openwall.com/lists/oss-security/2023/12/27/1