Test ID:	1.3.6.1.4.1.25623.1.0.55479
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-189-1 (cpio)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to cpio announced via advisory USN-189-1. A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) The following packages are affected: cpio Imran Ghory found a race condition in the handling of output files. While a file was unpacked with cpio, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the cpio user. (CVE-2005-1111) Imran Ghory discovered a path traversal vulnerability. Even when the --no-absolute-filenames option was specified, cpio did not filter out .. path components. By tricking an user into unpacking a malicious cpio archive, this could be exploited to install files in arbitrary paths with the privileges of the user calling cpio. (CVE-2005-1229) Solution: The problem can be corrected by upgrading the affected package to version 2.5-1.1ubuntu0.2 (for Ubuntu 4.10), or 2.5-1.1ubuntu1.1 (for Ubuntu 5.04). In general, a standard system upgrade is sufficient to effect the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-189-1 Risk factor : Medium CVSS Score: 4.6
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2005-1111 BugTraq ID: 13159 http://www.securityfocus.com/bid/13159 Bugtraq: 20050413 cpio TOCTOU file-permissions vulnerability (Google Search) http://marc.info/?l=bugtraq&m=111342664116120&w=2 Debian Security Information: DSA-846 (Google Search) http://www.debian.org/security/2005/dsa-846 FreeBSD Security Advisory: FreeBSD-SA-06:03 ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:03.cpio.asc http://www.osvdb.org/15725 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A358 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9783 http://www.redhat.com/support/errata/RHSA-2005-378.html http://www.redhat.com/support/errata/RHSA-2005-806.html SCO Security Bulletin: SCOSA-2005.32 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.32/SCOSA-2005.32.txt SCO Security Bulletin: SCOSA-2006.2 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2/SCOSA-2006.2.txt http://secunia.com/advisories/16998 http://secunia.com/advisories/17123 http://secunia.com/advisories/17532 http://secunia.com/advisories/18290 http://secunia.com/advisories/18395 http://secunia.com/advisories/20117 SuSE Security Announcement: SUSE-SR:2006:010 (Google Search) http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html http://www.ubuntu.com/usn/usn-189-1 Common Vulnerability Exposure (CVE) ID: CVE-2005-1229 BugTraq ID: 13291 http://www.securityfocus.com/bid/13291 Bugtraq: 20050420 cpio directory traversal vulnerability (Google Search) http://marc.info/?l=bugtraq&m=111403177526312&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2007:233 http://www.osvdb.org/17939 http://secunia.com/advisories/27857 XForce ISS Database: cpio-directory-traversal(20204) https://exchange.xforce.ibmcloud.com/vulnerabilities/20204
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.