Executive Summary
Summary | |
---|---|
Title | cpio security update |
Informations | |||
---|---|---|---|
Name | RHSA-2005:073 | First vendor Publication | 2005-02-15 |
Vendor | RedHat | Last vendor Modification | 2005-02-15 |
Severity (Vendor) | Low | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: An updated cpio package that fixes a umask bug is now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: GNU cpio copies files into or out of a cpio or tar archive. It was discovered that cpio uses a 0 umask when creating files using the -O (archive) option. This creates output files with mode 0666 (all can read and write) regardless of the user's umask setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-1999-1572 to this issue. Users of cpio should upgrade to this updated package, which resolves this issue. Red Hat would like to thank Mike O'Connor for bringing this issue to our attention. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 145725 - CAN-1999-1572 cpio insecure file creation |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2005-073.html |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10878 | |||
Oval ID: | oval:org.mitre.oval:def:10878 | ||
Title: | Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message. | ||
Description: | Cross-site scripting (XSS) vulnerability in ht://dig (htdig) before 3.1.6-r7 allows remote attackers to execute arbitrary web script or HTML via the config parameter, which is not properly sanitized before it is displayed in an error message. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2005-0085 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:10888 | |||
Oval ID: | oval:org.mitre.oval:def:10888 | ||
Title: | cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files. | ||
Description: | cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-1999-1572 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2009-10-10 | Name : SLES9: Security update for htdig File : nvt/sles9p5018082.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200502-16 (htdig) File : nvt/glsa_200502_16.nasl |
2008-09-04 | Name : FreeBSD Ports: htdig File : nvt/freebsd_htdig.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 664-1 (cpio) File : nvt/deb_664_1.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 680-1 (htdig) File : nvt/deb_680_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
13520 | ht://Dig (htdig) config Parameter XSS ht://Dig (htdig) contains a flaw that allows a remote cross site scripting (XSS) attack. This flaw exists because the application does not validate the 'config' parameter upon submission to an unspecified script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. |
13350 | cpio -O Parameter umask Permission Weakness |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_9833.nasl - Type : ACT_GATHER_INFO |
2006-05-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_673aec6f1cae11dabc01000e0c2e438a.nasl - Type : ACT_GATHER_INFO |
2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-75-1.nasl - Type : ACT_GATHER_INFO |
2005-11-15 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-806.nasl - Type : ACT_GATHER_INFO |
2005-04-01 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-063.nasl - Type : ACT_GATHER_INFO |
2005-02-22 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-073.nasl - Type : ACT_GATHER_INFO |
2005-02-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-090.nasl - Type : ACT_GATHER_INFO |
2005-02-18 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-080.nasl - Type : ACT_GATHER_INFO |
2005-02-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-680.nasl - Type : ACT_GATHER_INFO |
2005-02-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200502-16.nasl - Type : ACT_GATHER_INFO |
2005-02-11 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2005-032.nasl - Type : ACT_GATHER_INFO |
2005-02-08 | Name : The remote host contains a web search engine that is affected by a cross-site... File : htdig_xss2.nasl - Type : ACT_GATHER_INFO |
2005-02-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-664.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:48:59 |
|