CPIO Tar Hostile Destination Path Vulnerability
BID:6415
Info
CPIO Tar Hostile Destination Path Vulnerability
| Bugtraq ID: | 6415 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 17 2002 12:00AM |
| Updated: | Dec 17 2002 12:00AM |
| Credit: | Discovery of this issue is credited to Florian Schafferhans <[email protected]>. |
| Vulnerable: |
GNU cpio 2.5 GNU cpio 2.4.2 |
| Not Vulnerable: | |
Discussion
CPIO Tar Hostile Destination Path Vulnerability
cpio is prone to a security vulnerability when unpacking .tar archives. The problem is in the handling of pathnames.
By specifying a path for an archived item which points outside the expected directory scope, the creator of the archive can cause the file to be extracted to arbitrary locations on the filesystem. An attacker may take advantage of this vulnerability to cause malicious files to be placed anywhere on a target filesystem.
cpio is prone to a security vulnerability when unpacking .tar archives. The problem is in the handling of pathnames.
By specifying a path for an archived item which points outside the expected directory scope, the creator of the archive can cause the file to be extracted to arbitrary locations on the filesystem. An attacker may take advantage of this vulnerability to cause malicious files to be placed anywhere on a target filesystem.
Exploit / POC
CPIO Tar Hostile Destination Path Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
CPIO Tar Hostile Destination Path Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
CPIO Tar Hostile Destination Path Vulnerability
References:
References:
- Directory traversal vulnerabilities in several archivers processing .tar (Florian Schafferhans