cpio: directory traversal [LWN.net]

Package(s):

cpio

CVE #(s):

CAN-2005-1111

Created:

June 20, 2005

Updated:

December 26, 2005

Description:

There is a vulnerability in cpio (2.6 and previous) that allows a malicious cpio file to extract to an arbitrary directory of the attackers choice. cpio will extract to the path specified in the cpio file, this path can be absolute.

Alerts:

Mandriva	MDKSA-2005:237	2005-12-23
Red Hat	RHSA-2005:806-01	2005-11-10
Debian	DSA-846-1	2005-10-07
Ubuntu	USN-189-1	2005-09-29
Red Hat	RHSA-2005:378-01	2005-07-21
Mandriva	MDKSA-2005:116-1	2005-07-19
Mandriva	MDKSA-2005:116	2005-07-11
Trustix	TSLSA-2005-0030	2005-06-24
Gentoo	200506-16	2005-06-20

(Log in to post comments)

cpio: directory traversal

Posted Jul 15, 2005 21:34 UTC (Fri) by jonabbey (subscriber, #2736) [Link]

Presumably this is specific to GNU cpio?