Four years have passed since the last release. The release of the cpio 2.13 file archiving utility, used in RPM packages and initramfs, has been announced. This new version fixes three vulnerabilities:
- — allows files to be overwritten outside the directory where the archive is extracted.
- — results in writing to an area outside the allocated buffer when processing specially crafted cpio files;
- ) — due to insufficient checking of the TAR file header, it allows the creation of a TAR archive from a list of files that, if containing a specially crafted very large tar archive, results in the resulting archive including files extracted from the added tar archive with incorrect access rights.
tar cf suffix.tar AUTHORS
dd if=/dev/zero seek=16G bs=1 count=0 of=suffix.tar
echo suffix.tar | cpio -H tar -o | tar tvf —-rw-r--r-- 1000/1000 0 2019-08-30 16:40 suffix.tar
-rw-r--r-- thomas/thomas 161 2019-08-30 16:40 AUTHORS
In addition, in the library , which provides tools for working with various archive formats and compressed files, (), which leads to access to an already freed memory block (use-after-free) when processing specially crafted RAR files. This issue could potentially allow code execution by an attacker, but the likelihood of exploitation is considered low (the risk level is rated 4.4 out of 10, indicating that the problem is deemed non-severe). The issue is reported discreetly. in the release .
Source: opennet.ru
