PT-2005-2128 · Gnu+1 · Cpio+1
Imran Ghory
·
Publicado
2005-04-16
·
Atualizado
2024-01-26
·
CVE-2005-1111
CVSS v3.1
4.7
Média
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
cpio versions 2.6 and earlier
Description
A race condition issue allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed. The permissions of the file are changed by cpio after the decompression is complete.
Recommendations
For cpio versions 2.6 and earlier, consider restricting access to the cpio decompression functionality until a patch is available. As a temporary workaround, avoid using cpio for decompressing files that require specific permission settings. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Link Following
Time Of Check To Time Of Use
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Red Hat
Cpio