Bug 155749

Summary: CVE-2005-1111 Race condition in cpio
Product: Red Hat Enterprise Linux 4 Reporter: Josh Bressers <bressers>
Component: cpioAssignee: Peter Vrabec <pvrabec>
Status: CLOSED ERRATA QA Contact: Brock Organ <borgan>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.0CC: tao
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20050413,source=bugtraq,reported=20050413
Fixed In Version: RHSA-2005:378 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-04-30 02:51:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Proposed patch from Steve Grubb
none
I suggest to use this patch. none

Description Josh Bressers 2005-04-22 18:45:45 UTC 
Race condition in cpio 2.6 and earlier allows local users to modify permissions
of arbitrary files via a hard link attack on a file while it is being
decompressed, whose permissions are changed by cpio after the decompression is
complete.

http://marc.theaimsgroup.com/?l=bugtraq&m=111342664116120&w=2
Comment 1 Josh Bressers 2005-04-22 18:50:20 UTC 
This issue should also affect RHEL2.1 and RHEL3.
Comment 2 Mark J. Cox 2005-04-29 13:44:08 UTC 
Created attachment 113839 [details]
Proposed patch from Steve Grubb
Comment 3 Peter Vrabec 2005-07-01 09:38:30 UTC 
Created attachment 116230 [details]
I suggest to use this patch.

Steve's patch doesn't solve race condition on directories. My fix use mode 0700
for dir creation, which close some more holes.
Comment 5 Josh Bressers 2005-09-30 15:05:31 UTC 
We have not released an update for this issue on RHEL2.1 yet.  RHEL3 and RHEL4
were fixed in RHSA-2005:378
Comment 7 Bastien Nocera 2005-10-03 10:08:13 UTC 
The RHEL 2.1 bug in being tracked in bug #169760