{"id":52355,"date":"2019-11-06T00:00:00","date_gmt":"2019-11-05T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-cpio-i-libarchive"},"modified":"2020-02-18T14:00:03","modified_gmt":"2020-02-18T11:00:03","slug":"uyazvimosti-v-cpio-i-libarchive","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","title":{"rendered":"Ranljivosti v cpio in libarchive","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Po \u0161tirih letih od zadnjega izida <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/info-gnu@gnu.org\/msg02668.html\">objavljen<\/a><\/noindex> je iz\u0161el nov izdelek za arhiviranje datotek cpio 2.13, ki se uporablja v RPM paketih in initramfs. V novi razli\u010dici so odpravili tri ranljivosti:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2015-1197\">CVE-2015-1197<\/a><\/noindex> \u2014 omogo\u010da prepisovanje datotek izven imenika, v katerega se razpakira arhiv.\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2016-2037\">CVE-2016-2037<\/a><\/noindex> \u2014 povzro\u010da zapisovanje na obmo\u010dje izven izbrisanega predpomnilnika pri obdelavi posebej oblikovanih datotek cpio;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=CVE-2019-14866\">CVE-2019-14866<\/a><\/noindex>) \u2014 zaradi nezadostne preverjanja glave TAR-datoteke omogo\u010da pri ustvarjanju arhiva v formatu TAR iz seznama datotek, v primeru prisotnosti v tem seznamu posebej oblikovanega zelo velikega tar-arhiva, ustvariti rezultantni arhiv, ki vklju\u010duje datoteke, razpakirane iz dodanega tar-arhiva z nepravilnimi pravicami dostopa.\n<p>    tar cf suffix.tar AUTHORS<br \/>\n    dd if=\/dev\/zero seek=16G bs=1 count=0 of=suffix.tar<br \/>\n    echo suffix.tar | cpio -H tar -o | tar tvf \u2014<\/p>\n<p>    -rw-r--r-- 1000\/1000       0 2019-08-30 16:40 suffix.tar<br \/>\n    -rw-r--r-- thomas\/thomas 161 2019-08-30 16:40 AUTHORS<\/p>\n<\/ul>\n<p>Poleg tega, v knji\u017enici <noindex><a rel=\"nofollow\" href=\"https:\/\/www.libarchive.org\/\">Libarchive<\/a><\/noindex>, ki nudi sredstva za delo z razli\u010dnimi formati arhivov in stisnjenimi datotekami, <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.firosolutions.com\/exploits\/libarchi\">odkrita<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2019-18408\">ranljivost<\/a><\/noindex> (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-18408\">CVE-2019-18408<\/a><\/noindex>), ki privede do dostopa do \u017ee spro\u0161\u010denega bloka pomnilnika (use-after-free) pri obdelavi posebej oblikovanih datotek v formatu RAR. Te\u017eava lahko potencialno privede do izvedbe zlonamerne kode, vendar je mo\u017enost izkori\u0161\u010danja obravnavana kot zelo malo verjetna (stopnja tveganja je ocenjena na 4.4 od 10, torej je te\u017eava priznana kot manj nevarna). Te\u017eava brez dodatne razprave <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/libarchive\/libarchive\/commit\/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60\">ispravljena<\/a><\/noindex> in the release <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/libarchive\/libarchive\/releases\/tag\/v3.4.0\">3.4.0<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51820\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 RPM \u0438 \u0432 initramfs. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2015-1197 &#8212; \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0430\u0440\u0445\u0438\u0432. CVE-2016-2037 &#8212; \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u0432\u043d\u0435 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-52355","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-cpio-i-libarchive\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 cpio \u0438 libarchive | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-cpio-i-libarchive\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-05T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:00:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivosti v cpio in libarchive | ProHoster","description":"Po \u0161tirih letih od zadnjega izida je bil objavljen izdelek za arhiviranje datotek cpio 2.13.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 cpio \u0438 libarchive | ProHoster","og:description":"\u0421\u043f\u0443\u0441\u0442\u044f \u0447\u0435\u0442\u044b\u0440\u0435 \u0433\u043e\u0434\u0430 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 cpio 2.13.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-cpio-i-libarchive","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-05T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52355","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 03:20:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:45:28","updated":"2026-01-24 03:20:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/52355","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=52355"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/52355\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=52355"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=52355"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=52355"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}