- Wed Oct 24 2007 Radek Brich <rbrich at redhat.com>     2:1.17-4

    - upstream patch for CVE-2007-4476 (tar stack crashing       in safer_name_suffix)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in GNU tar has unspecified attack vectors and impact, resulting in a crashing stack.

Updated packages fix this issue.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2010-0144 advisory.

    - CVE-2010-0624 fix heap-based buffer overflow by expanding       a specially-crafted archive

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes a bug in function safer_name_suffix() of cpio which leads to a crashing stack. Exploitability is unknown. (CVE-2007-4476)

An updated cpio package that fixes two security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

Red Hat would like to thank Jakob Lell for responsibly reporting the CVE-2010-0624 issue.

A denial of service flaw was found in the way cpio expanded archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. (CVE-2007-4476)

Users of cpio are advised to upgrade to this updated package, which contains backported patches to correct these issues.

The remote NewStart CGSL host, running version MAIN 4.05, has tar packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in tar 1.14 through 1.15.90 allows user-     assisted attackers to cause a denial of service     (application crash) and possibly execute code via     unspecified vectors involving PAX extended headers.
    (CVE-2006-0300)

  - GNU tar 1.16 and 1.15.1, and possibly other versions,     allows user-assisted attackers to overwrite arbitrary     files via a tar file that contains a GNUTYPE_NAMES     record with a symbolic link, which is not properly     handled by the extract_archive function in extract.c and     extract_mangle function in mangle.c, a variant of     CVE-2002-1216. (CVE-2006-6097)

  - Directory traversal vulnerability in the     contains_dot_dot function in src/names.c in GNU tar     allows user-assisted remote attackers to overwrite     arbitrary files via certain //.. (slash slash dot dot)     sequences in directory symlinks in a TAR archive.
    (CVE-2007-4131)

  - Buffer overflow in the safer_name_suffix function in GNU     tar has unspecified attack vectors and impact, resulting     in a crashing stack. (CVE-2007-4476)

  - Heap-based buffer overflow in the rmt_read__ function in     lib/rtapelib.c in the rmt client functionality in GNU     tar before 1.23 and GNU cpio before 2.11 allows remote     rmt servers to cause a denial of service (memory     corruption) or possibly execute arbitrary code by     sending more data than was requested, related to archive     filenames that contain a : (colon) character.
    (CVE-2010-0624)

  - Directory traversal vulnerability in the     safer_name_suffix function in GNU tar 1.14 through 1.29     might allow remote attackers to bypass an intended     protection mechanism and write to arbitrary files via     vectors related to improper sanitization of the     file_name parameter, aka POINTYFEATHER. (CVE-2016-6321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2005-4268 cpio large filesize buffer overflow

CVE-2007-4476 tar/cpio stack crashing in safer_name_suffix

CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

A stack-based buffer overflow flaw was found in the way cpio expanded large archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. This issue only affected 64-bit platforms. (CVE-2005-4268) - SL3 Only

A denial of service flaw was found in the way cpio expanded archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. (CVE-2007-4476) - SL5 Only

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0141 advisory.

  - tar/cpio stack crashing in safer_name_suffix (CVE-2007-4476)

  - tar, cpio: Heap-based buffer overflow by expanding a specially-crafted archive (CVE-2010-0624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2007-4476 tar/cpio stack crashing in safer_name_suffix

CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive

A heap-based buffer overflow flaw was found in the way tar expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the tar executable to crash or execute arbitrary code with the privileges of the user running tar.
(CVE-2010-0624)

A denial of service flaw was found in the way tar expanded archive files. If a user expanded a specially crafted archive, it could cause the tar executable to crash. (CVE-2007-4476) - SL4 and SL5 Only

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
27806	Fedora 8 : tar-1.17-4.fc8 (2007-2800)	Nessus	Fedora Local Security Checks	2007/11/7	2021/1/11	high
27070	Mandrake Linux Security Advisory : tar (MDKSA-2007:197)	Nessus	Mandriva Local Security Checks	2007/10/17	2021/1/6	high
68011	Oracle Linux 5 : cpio (ELSA-2010-0144)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
29406	SuSE 10 Security Update : cpio (ZYPP Patch Number 4184)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high
46267	RHEL 5 : cpio (RHSA-2010:0144)	Nessus	Red Hat Local Security Checks	2010/5/11	2021/1/14	high
127428	NewStart CGSL MAIN 4.05 : tar Multiple Vulnerabilities (NS-SA-2019-0153)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	high
60745	Scientific Linux Security Update : cpio on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
46264	RHEL 4 / 5 : tar (RHSA-2010:0141)	Nessus	Red Hat Local Security Checks	2010/5/11	2024/4/21	critical
60747	Scientific Linux Security Update : tar on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

检测

插件搜索

high

high

critical

high

high

high

high

critical

high