Synopsis

Low: cpio security and bug fix update

Type/Severity

Security Advisory: Low

Topic

An updated cpio package that fixes a security issue and various bugs is now
available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

GNU cpio copies files into or out of a cpio or tar archive.

A buffer overflow was found in cpio on 64-bit platforms. By tricking a
user into adding a specially crafted large file to a cpio archive, a local
attacker may be able to exploit this flaw to execute arbitrary code with
the target user's privileges. (CVE-2005-4268)

This erratum also addresses the following bugs:

• cpio did not set exit codes appropriately.
  
• cpio did not create a ram disk properly.
  

All users of cpio are advised to upgrade to this updated package, which
contains backported fixes to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 172865 - CVE-2005-4268 cpio large filesize buffer overflow

CVEs

• CVE-2005-4268

References

• http://www.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 4

SRPM
cpio-2.5-13.RHEL4.src.rpm	SHA-256: 4d4ec84a267c068eb303a93cc385547dfdbba19a7d99a81a7e7c15e4a3828bf2
x86_64
cpio-2.5-13.RHEL4.x86_64.rpm	SHA-256: 0dafb98eeab342ccbea89429190c41f9db5ca112bf3e37bf7b2c8b9688c33381
cpio-2.5-13.RHEL4.x86_64.rpm	SHA-256: 0dafb98eeab342ccbea89429190c41f9db5ca112bf3e37bf7b2c8b9688c33381
ia64
cpio-2.5-13.RHEL4.ia64.rpm	SHA-256: 3a942703643d225396c3e2def2f1b9a152ec96c0fcbe6933420c676a6a39c30f
cpio-2.5-13.RHEL4.ia64.rpm	SHA-256: 3a942703643d225396c3e2def2f1b9a152ec96c0fcbe6933420c676a6a39c30f
i386
cpio-2.5-13.RHEL4.i386.rpm	SHA-256: 9f945f149bd5bef4d97162835c8f595c99d80105ad8910e6a278c98d40d67076
cpio-2.5-13.RHEL4.i386.rpm	SHA-256: 9f945f149bd5bef4d97162835c8f595c99d80105ad8910e6a278c98d40d67076

Red Hat Enterprise Linux Workstation 4

SRPM
cpio-2.5-13.RHEL4.src.rpm	SHA-256: 4d4ec84a267c068eb303a93cc385547dfdbba19a7d99a81a7e7c15e4a3828bf2
x86_64
cpio-2.5-13.RHEL4.x86_64.rpm	SHA-256: 0dafb98eeab342ccbea89429190c41f9db5ca112bf3e37bf7b2c8b9688c33381
ia64
cpio-2.5-13.RHEL4.ia64.rpm	SHA-256: 3a942703643d225396c3e2def2f1b9a152ec96c0fcbe6933420c676a6a39c30f
i386
cpio-2.5-13.RHEL4.i386.rpm	SHA-256: 9f945f149bd5bef4d97162835c8f595c99d80105ad8910e6a278c98d40d67076

Red Hat Enterprise Linux Desktop 4

SRPM
cpio-2.5-13.RHEL4.src.rpm	SHA-256: 4d4ec84a267c068eb303a93cc385547dfdbba19a7d99a81a7e7c15e4a3828bf2
x86_64
cpio-2.5-13.RHEL4.x86_64.rpm	SHA-256: 0dafb98eeab342ccbea89429190c41f9db5ca112bf3e37bf7b2c8b9688c33381
i386
cpio-2.5-13.RHEL4.i386.rpm	SHA-256: 9f945f149bd5bef4d97162835c8f595c99d80105ad8910e6a278c98d40d67076

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
cpio-2.5-13.RHEL4.src.rpm	SHA-256: 4d4ec84a267c068eb303a93cc385547dfdbba19a7d99a81a7e7c15e4a3828bf2
s390x
cpio-2.5-13.RHEL4.s390x.rpm	SHA-256: 336994ae9d56603b3e5c6c7c5915ce1941babedb2703eba5c3b75f631e711d19
s390
cpio-2.5-13.RHEL4.s390.rpm	SHA-256: 072d1258c11f20f21b9d6c6704059565f23ac574f30554d35947ca2c42f1f2a9

Red Hat Enterprise Linux for Power, big endian 4

SRPM
cpio-2.5-13.RHEL4.src.rpm	SHA-256: 4d4ec84a267c068eb303a93cc385547dfdbba19a7d99a81a7e7c15e4a3828bf2
ppc
cpio-2.5-13.RHEL4.ppc.rpm	SHA-256: 4bff87672abcc2e5552f3d43da6889baeea93142e22a331239b23a1a40e25ef5