PT-2016-1311 · Gnu+3 · Cpio+3

Gustavo Grieco · Published 2015-12-14 · Updated 2024-06-15 · CVE-2016-2037

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cpio version 2.11

Description The issue is related to the cpio safer name suffix function in the cpio utility, which allows remote attackers to cause a denial of service due to an out-of-bounds write. This can be achieved by exploiting the function with a crafted cpio file, potentially leading to a buffer overflow. The exploitation of this issue may result in a denial of service.

Recommendations For cpio version 2.11, consider avoiding the use of the cpio safer name suffix function until a patch is available. As a temporary workaround, restrict the processing of crafted cpio files to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2015-2097

BDU:2016-00608

CVE-2016-2037

DLA-415-1

DSA-3483-1

MGASA-2016-0063

OPENSUSE-SU-2024:10143-1

SUSE-SU-2017:0366-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_0366-1

USN-2906-1

Affected Products

Alt Linux

Suse

Ubuntu

Cpio

References · 30

• http://debian.org/security/2016/dsa-3483 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00608 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-2037 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2037 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2037 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0063.html · Security Note
• http://ubuntu.com/usn/USN-2906-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0063 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2906-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2037 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10143-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2037 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2037 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2037 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3483-1 · Vendor Advisory