Bug 1539685 (CVE-2017-7516)
| Summary: | CVE-2017-7516 cpio: --no-absolute-filenames bypass via symlinks | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Cedric Buissart <cbuissar> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED DUPLICATE | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | carnil, cbuissar, databases-maint, dmoppert, hhorak, kdudka, ovasik, praiskup, tomm.momi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
[REJECTED CVE] A vulnerability was identified in the GNU cpio package where the --no-absolute-filenames option, intended to restrict extraction to the current directory, can be bypassed using crafted symlinks. During extraction, cpio will first create the symlink and then follow it for subsequent entries, allowing a malicious archive to write files outside the intended directory (e.g., /tmp/file). An attacker could exploit this by tricking a user, into extracting such an archive, potentially leading to arbitrary file creation, privilege escalation, or data corruption.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-02-23 11:55:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1188590, 1539687, 1539688 | ||
| Bug Blocks: | 1458829 | ||
|
Description
Cedric Buissart
2018-01-29 12:44:53 UTC
External References: http://lists.gnu.org/archive/html/bug-cpio/2017-06/msg00001.html Created cpio tracking bugs for this issue: Affects: fedora-all [bug 1539688] Acknowledgments: Name: Cedric Buissart (Red Hat) Hi Cedric, Isn't that a duplicate of CVE-2015-1197? Regards, Salvatore Sorry to be more specific, there are references in the MITRE entry at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1197 . https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html Was posted on the cpio bug list, but I think it never got a reply. Several distributions seem to have then applied the patch from SuSE (at least in Debian, SUSE, Ubuntu, Mageia). Regards, Salvatore Hi Doran, hi Cedric https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7516 has been updated. Regards, Salvatore Hi Salvatore, Ouch ... thanks! I had missed it :( *** This bug has been marked as a duplicate of bug 1179773 *** |