{"id":52355,"date":"2019-11-06T00:00:00","date_gmt":"2019-11-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-cpio-i-libarchive"},"modified":"2020-02-18T14:00:03","modified_gmt":"2020-02-18T11:00:03","slug":"uyazvimosti-v-cpio-i-libarchive","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","title":{"rendered":"cpio v\u0259 libarchive-d\u0259ki z\u0259iflikl\u0259r","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>D\u00f6rd ild\u0259n sonra <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/info-gnu@gnu.org\/msg02668.html\">n\u0259\u015fr olundu<\/a><\/noindex> cpio 2.13 fayl arxivl\u0259\u015fdirm\u0259 vasit\u0259sinin burax\u0131l\u0131\u015f\u0131, RPM paketl\u0259rind\u0259 v\u0259 initramfs-d\u0259 istifad\u0259 olunur. Yeni burax\u0131l\u0131\u015fda \u00fc\u00e7 z\u0259iflik aradan qald\u0131r\u0131l\u0131b:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2015-1197\">CVE-2015-1197<\/a><\/noindex> \u2014 arxiv a\u00e7\u0131ld\u0131qdan sonra, arxiv\u0259 daxil olan fayllar\u0131 kopyalama\u011fa imkan yarad\u0131r.\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2016-2037\">CVE-2016-2037<\/a><\/noindex> \u2014 x\u00fcsusi dizayn edilmi\u015f cpio fayllar\u0131 emal edil\u0259rk\u0259n, se\u00e7ilmi\u015f tamponun xaricind\u0259 yazma\u011f\u0131 h\u0259yata ke\u00e7irir;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=CVE-2019-14866\">CVE-2019-14866<\/a><\/noindex>) \u2014 TAR-fayl\u0131n\u0131n ba\u015fl\u0131\u011f\u0131n\u0131n kifay\u0259t q\u0259d\u0259r yoxlan\u0131lmamas\u0131 s\u0259b\u0259bind\u0259n, \u0259g\u0259r fayllar siyah\u0131s\u0131ndan yarad\u0131lan TAR formatl\u0131 arxiv\u0259 x\u00fcsusi dizayn edilmi\u015f \u00e7ox b\u00f6y\u00fck bir tar arxivi daxil edil\u0259rs\u0259, bu n\u0259tic\u0259d\u0259, qo\u015fulmu\u015f tar arxivind\u0259n \u00e7\u0131xar\u0131lm\u0131\u015f fayllar\u0131 yarad\u0131r, d\u00fczg\u00fcn yetki h\u00fcquqlar\u0131n\u0131 \u0259hat\u0259 etmir.\n<p>    tar cf suffix.tar AUTHORS<br \/>\n    dd if=\\\/dev\\\/zero seek=16G bs=1 count=0 of=suffix.tar<br \/>\n    echo suffix.tar | cpio -H tar -o | tar tvf \u2014<\/p>\n<p>    -rw-r--r-- 1000\/1000       0 2019-08-30 16:40 suffix.tar<br \/>\n    -rw-r--r-- thomas\/thomas 161 2019-08-30 16:40 AUTHORS<\/p>\n<\/ul>\n<p>Bundan \u0259lav\u0259, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.libarchive.org\/\">Libarchive<\/a><\/noindex>, m\u00fcxt\u0259lif arxiv formatlar\u0131 v\u0259 s\u0131x\u0131lm\u0131\u015f fayllarla i\u015fl\u0259m\u0259k \u00fc\u00e7\u00fcn m\u00fcvafiq vasit\u0259l\u0259r t\u0259qdim ed\u0259n bir kitabxanad\u0131r. <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.firosolutions.com\/exploits\/libarchi\">k\u0259\u015ff edilib<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2019-18408\">z\u0259iflik<\/a><\/noindex> (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-18408\">CVE-2019-18408<\/a><\/noindex>), bu, RAR format\u0131nda x\u00fcsusi haz\u0131rlanm\u0131\u015f fayllar\u0131 emal ed\u0259rk\u0259n art\u0131q azad edilmi\u015f yadda\u015f blokuna (use-after-free) m\u00fcraci\u0259t etm\u0259y\u0259 s\u0259b\u0259b olur. Problemin potensial olaraq bir hakerin kodunu i\u015f\u0259 salmas\u0131 m\u00fcmk\u00fcnd\u00fcr, lakin istismar edilm\u0259 ehtimal\u0131 a\u015fa\u011f\u0131 hesab edilir (t\u0259hl\u00fck\u0259 s\u0259viyy\u0259si 10-dan 4.4, y\u0259ni problem t\u0259hl\u00fck\u0259siz say\u0131l\u0131r). Problemin h\u0259lli he\u00e7 bir \u00e7\u0259kinm\u0259d\u0259n <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/libarchive\/libarchive\/commit\/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60\">aradan qald\u0131r\u0131l\u0131b<\/a><\/noindex> burax\u0131l\u0131\u015fda <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/libarchive\/libarchive\/releases\/tag\/v3.4.0\">3.4.0<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>M\u0259nb\u0259: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51820\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 RPM \u0438 \u0432 initramfs. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2015-1197 &#8212; \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u0440\u0445\u0438\u0432. CVE-2016-2037 &#8212; \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u0432\u043d\u0435 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52355","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimosti-v-cpio-i-libarchive\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"az_AZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 cpio \u0438 libarchive | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimosti-v-cpio-i-libarchive\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-05T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:00:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47cpio v\u0259 libarchive-d\u0259 z\u0259iflikl\u0259r | ProHoster","description":"D\u00f6rd ild\u0259n sonra cpio 2.13 fayl arxivl\u0259\u015fdirm\u0259 vasit\u0259sinin burax\u0131l\u0131\u015f\u0131 yay\u0131mland\u0131.","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 cpio \u0438 libarchive | ProHoster","og:description":"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:45:28","updated":"2026-01-24 03:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=52355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/52355\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=52355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=52355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=52355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}