Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 90619 - app-arch/cpio absolut-path issue
Summary: app-arch/cpio absolut-path issue
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa] jaervosz
Depends on:
Reported: 2005-04-27 08:01 UTC by Sune Kloppenborg Jeppesen
Modified: 2005-06-29 19:02 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

cpio-2.6-alt-safer_name_suffix.patch (cpio-2.6-alt-safer_name_suffix.patch,5.43 KB, patch)
2005-04-27 08:02 UTC, Sune Kloppenborg Jeppesen
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen gentoo-dev 2005-04-27 08:01:19 UTC
cpio is vulnerable to a absolut-path issue which allows to unpack the content to any location.
Comment 1 Sune Kloppenborg Jeppesen gentoo-dev 2005-04-27 08:02:34 UTC
Created attachment 57389 [details, diff]

Proposed patch by Dmitry V. Levin from
Comment 2 SpanKY gentoo-dev 2005-05-02 11:26:05 UTC
anyone know if cpio gnu maintainers have been notified ?  the fix isnt in their upstream CVS

also, i dont think we need to keep this locked down ... redhat has added the patch to their public CVS ...
Comment 3 SpanKY gentoo-dev 2005-05-02 14:46:29 UTC
cpio-2.6-r3 now in portage with the redhat fix
Comment 4 Sune Kloppenborg Jeppesen gentoo-dev 2005-05-02 22:29:37 UTC
Thx SpanKY.

Arches please test and mark stable.
Comment 5 Jan Brinkmann (RETIRED) gentoo-dev 2005-05-03 05:40:56 UTC
stable on amd64
Comment 6 Gustavo Zacarias (RETIRED) gentoo-dev 2005-05-03 06:05:48 UTC
sparc stable.
Comment 7 Omkhar Arasaratnam (RETIRED) gentoo-dev 2005-05-03 07:55:24 UTC
ppc64 stable
Comment 8 Olivier Crete (RETIRED) gentoo-dev 2005-05-03 10:08:18 UTC
x86 stable
Comment 9 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-05-03 13:06:24 UTC
Stable on ppc.
Comment 10 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-05-03 14:05:43 UTC
Stable on hppa.
Comment 11 Hasan Khalil (RETIRED) gentoo-dev 2005-05-03 16:48:44 UTC
Stable on ppc-macos.
Comment 12 Bryan Østergaard (RETIRED) gentoo-dev 2005-05-04 01:24:26 UTC
Stable on alpha + ia64.
Comment 13 SpanKY gentoo-dev 2005-05-04 15:50:18 UTC
arm/s390 stable
Comment 14 Sune Kloppenborg Jeppesen gentoo-dev 2005-05-05 13:35:10 UTC
SpanKY thx for fixing CAN-2005-1111 (The TOCTOU issue) reference from the URL above. But as far as I understand it these are two different problems.
Comment 15 SpanKY gentoo-dev 2005-05-05 14:51:24 UTC
heh, yes they are

i'll make another cpio but for the correct bug this time ;)
Comment 16 Sune Kloppenborg Jeppesen gentoo-dev 2005-05-08 22:36:05 UTC
SpanKY do we have a fix in CVS for this one yet?
Comment 17 SpanKY gentoo-dev 2005-05-09 17:53:41 UTC
e-mailed upstream to see what they want to do
Comment 19 Sune Kloppenborg Jeppesen gentoo-dev 2005-05-15 22:23:15 UTC
SpanKY anything new on this one?
Comment 20 Sune Kloppenborg Jeppesen gentoo-dev 2005-05-25 06:52:22 UTC
SpanKY still no news?
Comment 21 SpanKY gentoo-dev 2005-06-16 21:35:15 UTC
sorry for the delay, my cvs checkout of upstream cpio was all screwed up so i
was trying to wait for them :/

cpio-2.6-r4 now in portage with fix
Comment 22 Sune Kloppenborg Jeppesen gentoo-dev 2005-06-16 22:09:50 UTC
Arches please test and mark stable.   
Note: If anyone is on m68k, please create an arch alias. 
Comment 23 Markus Rothe (RETIRED) gentoo-dev 2005-06-16 23:37:12 UTC
stable on ppc64
Comment 24 Gustavo Zacarias (RETIRED) gentoo-dev 2005-06-17 05:59:17 UTC
sparc stable.
Comment 25 René Nussbaumer (RETIRED) gentoo-dev 2005-06-17 06:21:55 UTC
Stable on hppa.
Comment 26 Jan Brinkmann (RETIRED) gentoo-dev 2005-06-17 10:13:20 UTC
stable on amd64
Comment 27 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-06-17 10:28:27 UTC
Stable on ppc.
Comment 28 Fernando J. Pereda (RETIRED) gentoo-dev 2005-06-17 12:15:03 UTC
alpha stable
Comment 29 Bryan Østergaard (RETIRED) gentoo-dev 2005-06-19 05:22:30 UTC
ia64 stable.
Comment 30 SpanKY gentoo-dev 2005-06-19 12:51:36 UTC
arm/s390/x86 stable
Comment 31 Luke Macken (RETIRED) gentoo-dev 2005-06-19 20:25:43 UTC
GLSA 200506-16, thanks everyone!
Comment 32 Joshua Kinard gentoo-dev 2005-06-29 19:02:34 UTC
mips stable.