ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2019.0326
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2019-0326)
Resumen:	The remote host is missing an update for the 'cpio' package(s) announced via the MGASA-2019-0326 advisory.
Descripción:	Summary: The remote host is missing an update for the 'cpio' package(s) announced via the MGASA-2019-0326 advisory. Vulnerability Insight: in cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive (CVE-2015-1197). Thomas Habets discovered that GNU cpio incorrectly handled certain inputs. An attacker could possibly use this issue to privilege escalation (CVE-2019-14866). cpio has been updated to 2.13 that fixes these issues. Affected Software/OS: 'cpio' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2015-1197 BugTraq ID: 71914 http://www.securityfocus.com/bid/71914 http://www.mandriva.com/security/advisories?name=MDVSA-2015:066 http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669 https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html http://www.openwall.com/lists/oss-security/2015/01/07/5 http://www.openwall.com/lists/oss-security/2015/01/18/7 http://www.openwall.com/lists/oss-security/2023/12/21/8 http://www.openwall.com/lists/oss-security/2023/12/27/1 http://www.ubuntu.com/usn/USN-2906-1 Common Vulnerability Exposure (CVE) ID: CVE-2019-14866 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14866 https://lists.gnu.org/archive/html/bug-cpio/2019-08/msg00003.html https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html https://lists.debian.org/debian-lts-announce/2023/06/msg00007.html
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.