{"id":52355,"date":"2019-11-06T00:00:00","date_gmt":"2019-11-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-cpio-i-libarchive"},"modified":"2020-02-18T14:00:03","modified_gmt":"2020-02-18T11:00:03","slug":"uyazvimosti-v-cpio-i-libarchive","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","title":{"rendered":"Vainojam\u012bbas cpio un libarchive","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>P\u0113c \u010detriem gadiem kop\u0161 iepriek\u0161\u0113j\u0101 izlaiduma <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/info-gnu@gnu.org\/msg02668.html\">public\u0113ts<\/a><\/noindex> tika izlaista 2.13 versija cpio r\u012bka, ko izmanto failu arhiv\u0113\u0161anai RPM paket\u0113s un initramfs. Jaunaj\u0101 izlaidum\u0101 ir nov\u0113rstas tr\u012bs ievainojam\u012bbas:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2015-1197\">CVE-2015-1197<\/a><\/noindex> \u2014 \u013cauj p\u0101rrakst\u012bt failus \u0101rpus direktorijas, uz kuru izpau\u017eas arh\u012bvs.\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2016-2037\">CVE-2016-2037<\/a><\/noindex> \u2014 izraisa ierakstu teritorij\u0101 \u0101rpus izcel\u0161anas bufera, apstr\u0101d\u0101jot \u012bpa\u0161i veidotus cpio failus;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=CVE-2019-14866\">CVE-2019-14866<\/a><\/noindex>) \u2014 nepietiekamas TAR faila galvas p\u0101rbaudes d\u0113\u013c \u013cauj, veidojot arh\u012bvu TAR form\u0101t\u0101 no failu saraksta, ja \u0161aj\u0101 sarakst\u0101 ir iek\u013cauts \u012bpa\u0161i veidots \u013coti liels tar arh\u012bvs, izveidot rezult\u0113jo\u0161o arh\u012bvu, kas ietver failus, kas izpild\u012bti no pievienot\u0101 tar arh\u012bva ar nepareiz\u0101m piek\u013cuves ties\u012bb\u0101m.\n<p>    tar cf suffix.tar AUTHORS<br \/>\n    dd if=\/dev\/zero seek=16G bs=1 count=0 of=suffix.tar<br \/>\n    echo suffix.tar | cpio -H tar -o | tar tvf \u2014<\/p>\n<p>    -rw-r\u2014r\u2014 1000\/1000       0 2019-08-30 16:40 suffix.tar<br \/>\n    -rw-r\u2014r\u2014 thomas\/thomas 161 2019-08-30 16:40 AUTHORS<\/p>\n<\/ul>\n<p>Turkl\u0101t, bibliot\u0113k\u0101 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.libarchive.org\/\">Libarchive<\/a><\/noindex>, kas nodro\u0161ina r\u012bkus darbam ar da\u017e\u0101diem arh\u012bvu un saspiesto failu form\u0101tiem, <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.firosolutions.com\/exploits\/libarchi\">identified<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2019-18408\">vulnerability<\/a><\/noindex> (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-18408\">CVE-2019-18408<\/a><\/noindex>), kas izraisa piek\u013cuvi jau atbr\u012bvotam atmi\u0146as blokam (use-after-free), apstr\u0101d\u0101jot \u012bpa\u0161i sagatavotus failus RAR form\u0101t\u0101. Probl\u0113ma potenci\u0101li var novest pie \u013caunpr\u0101t\u012bga kodu izpildes, bet iesp\u0113ja t\u0101s izmanto\u0161anai tiek uzskat\u012bta par maz ticamu (b\u012bstam\u012bbas l\u012bmenis nov\u0113rt\u0113ts k\u0101 4.4 no 10, t.i., probl\u0113ma tiek atz\u012bta par maz b\u012bstamu). Probl\u0113ma bez liekas publicit\u0101tes <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/libarchive\/libarchive\/commit\/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60\">ir nov\u0113rsta<\/a><\/noindex> izlaidum\u0101 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/libarchive\/libarchive\/releases\/tag\/v3.4.0\">3.4.0<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Avots: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51820\">opennet.lv<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 RPM \u0438 \u0432 initramfs. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2015-1197 &#8212; \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u0440\u0445\u0438\u0432. CVE-2016-2037 &#8212; \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u0432\u043d\u0435 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52355","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimosti-v-cpio-i-libarchive\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 cpio \u0438 libarchive | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimosti-v-cpio-i-libarchive\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-05T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:00:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Ievainojam\u012bbu p\u0101rskats par cpio un libarchive | ProHoster","description":"P\u0113c \u010detriem gadiem kop\u0161 iepriek\u0161\u0113j\u0101 izlaiduma ir public\u0113ta 2.13 versija cpio r\u012bka.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 cpio \u0438 libarchive | ProHoster","og:description":"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:45:28","updated":"2026-01-24 03:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/52355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=52355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/52355\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=52355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=52355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=52355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}