ID de Prueba:	1.3.6.1.4.1.25623.1.0.55822
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2005:806
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2005:806. GNU cpio copies files into or out of a cpio or tar archive. A race condition bug was found in cpio. It is possible for a local malicious user to modify the permissions of a local file if they have write access to a directory in which a cpio archive is being extracted. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1111 to this issue. It was discovered that cpio uses a 0 umask when creating files using the -O (archive) option. This creates output files with mode 0666 (all users can read and write) regardless of the user's umask setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-1572 to this issue. All users of cpio are advised to upgrade to this updated package, which contains backported fixes for these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2005-806.html Risk factor : Medium CVSS Score: 3.7
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-1999-1572 Bugtraq: 20050204 [USN-75-1] cpio vulnerability (Google Search) http://marc.info/?l=bugtraq&m=110763404701519&w=2 Debian Security Information: DSA-664 (Google Search) http://www.debian.org/security/2005/dsa-664 http://www.mandriva.com/security/advisories?name=MDKSA-2005:032 http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10888 http://www.redhat.com/support/errata/RHSA-2005-073.html http://www.redhat.com/support/errata/RHSA-2005-080.html http://www.redhat.com/support/errata/RHSA-2005-806.html http://secunia.com/advisories/14357 http://secunia.com/advisories/17063 http://secunia.com/advisories/17532 http://www.trustix.org/errata/2005/0003/ XForce ISS Database: cpio-o-archive-insecure-permissions(19167) https://exchange.xforce.ibmcloud.com/vulnerabilities/19167 Common Vulnerability Exposure (CVE) ID: CVE-2005-1111 BugTraq ID: 13159 http://www.securityfocus.com/bid/13159 Bugtraq: 20050413 cpio TOCTOU file-permissions vulnerability (Google Search) http://marc.info/?l=bugtraq&m=111342664116120&w=2 Debian Security Information: DSA-846 (Google Search) http://www.debian.org/security/2005/dsa-846 FreeBSD Security Advisory: FreeBSD-SA-06:03 ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:03.cpio.asc http://www.osvdb.org/15725 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A358 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9783 http://www.redhat.com/support/errata/RHSA-2005-378.html SCO Security Bulletin: SCOSA-2005.32 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.32/SCOSA-2005.32.txt SCO Security Bulletin: SCOSA-2006.2 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2/SCOSA-2006.2.txt http://secunia.com/advisories/16998 http://secunia.com/advisories/17123 http://secunia.com/advisories/18290 http://secunia.com/advisories/18395 http://secunia.com/advisories/20117 SuSE Security Announcement: SUSE-SR:2006:010 (Google Search) http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html http://www.ubuntu.com/usn/usn-189-1
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.