CPIO CHMod File Permission Modification Race Condition Weakness

CPIO CHMod File Permission Modification Race Condition Weakness

Solution:

Please see the references for vendor advisories and fixes.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.commailto:vuldb@securityfocus.com

GNU cpio 1.1

Ubuntu cpio_2.5-1.1ubuntu0.2_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/c/cpio/cpio_2.5-1.1ubuntu0 .2_amd64.deb

Ubuntu cpio_2.5-1.1ubuntu0.2_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/c/cpio/cpio_2.5-1.1ubuntu0 .2_i386.deb

Ubuntu cpio_2.5-1.1ubuntu0.2_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/c/cpio/cpio_2.5-1.1ubuntu0 .2_powerpc.deb

Ubuntu cpio_2.5-1.1ubuntu1.1_amd64.deb
Ubuntu 5.04 (Hoary Hedgehog)
http://security.ubuntu.com/ubuntu/pool/main/c/cpio/cpio_2.5-1.1ubuntu1 .1_amd64.deb

Ubuntu cpio_2.5-1.1ubuntu1.1_i386.deb
Ubuntu 5.04 (Hoary Hedgehog)
http://security.ubuntu.com/ubuntu/pool/main/c/cpio/cpio_2.5-1.1ubuntu1 .1_i386.deb

Ubuntu cpio_2.5-1.1ubuntu1.1_powerpc.deb
Ubuntu 5.04 (Hoary Hedgehog)
http://security.ubuntu.com/ubuntu/pool/main/c/cpio/cpio_2.5-1.1ubuntu1 .1_powerpc.deb

GNU cpio 2.5

Conectiva cpio-2.5-61325U10_1cl.i386.rpm
Conectiva 10
ftp://atualizacoes.conectiva.com.br/10/RPMS/cpio-2.5-61325U10_1cl.i386 .rpm

Mandriva cpio-2.5-4.2.100mdk.amd64.rpm
Mandriva Linux 10.0/AMD64
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.5-4.2.100mdk.i586.rpm
Mandriva Linux 10.0
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.5-4.2.C21mdk.i586.rpm
Mandriva Corporate Server 2.1
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.5-4.2.C21mdk.x86_64.rpm
Mandriva Corporate Server 2.1/x86_64
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.5-4.2.C30mdk.i586.rpm
Mandriva Corporate Server 3.0
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.5-4.2.C30mdk.x86_64.rpm
Mandriva Corporate Server 3.0/x86_64
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.5-4.3.101mdk.i586.rpm
Mandriva Linux 10.1
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.5-4.3.101mdk.x86_64.rpm
Mandriva Linux 10.1/x86_64
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.6-3.1.102mdk.i586.rpm
Mandriva Linux 10.2
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cpio-2.6-3.1.102mdk.x86_64.rpm
Mandriva Linux 10.2/x86_64
http://www1.mandrivalinux.com/en/ftp.php3

Turbolinux cpio-2.5-5.i586.rpm
Turbolinux 10 Server
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/up dates/RPMS/cpio-2.5-5.i586.rpm

Turbolinux cpio-2.5-5.src.rpm
Turbolinux 10 Server
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/up dates/SRPMS/cpio-2.5-5.src.rpm

Turbolinux cpio-debug-2.5-5.i586.rpm
Turbolinux 10 Server
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/up dates/RPMS/cpio-debug-2.5-5.i586.rpm

SGI ProPack 3.0 SP6

SGI Patch 10197
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS

FreeBSD FreeBSD 4.11 -STABLE

FreeBSD cpio.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:03/cpio.patch

FreeBSD FreeBSD 5.3

FreeBSD cpio.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:03/cpio.patch

FreeBSD FreeBSD 5.3 -STABLE

FreeBSD cpio.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:03/cpio.patch

FreeBSD FreeBSD 5.4 -RELENG

FreeBSD cpio.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:03/cpio.patch

FreeBSD FreeBSD 6.0 -STABLE

FreeBSD cpio.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:03/cpio.patch

SCO Open Server 6.0

SCO p532911.600_vol.tar
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2/p532911.600_vol. tar

FreeBSD FreeBSD 6.0 -RELEASE

FreeBSD cpio.patch
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-06:03/cpio.patch

SCO Unixware 7.1.4

SCO erg712854.uw714.pkg.Z
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.32/erg712854.uw714.p kg.Z