patchGNU cpio - Patches: patch #4005, cpio-2.6: fix directory traversal...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #4005: cpio-2.6: fix directory traversal issues in copy-in and copy-pass modes

Submitter:  Dmitry V. Levin <ldv>
Submitted:  Wed 11 May 2005 11:16:34 PM UTC
   
 
Category:  None Priority:  7 - High
Status:  Done Privacy:  Public
Assigned to:  None Open/Closed:  Closed

Discussion

Thu 12 May 2005 05:23:19 PM UTC, comment #3: 

That's great. However, it will change the default behavior of cpio, which means that many existing scripts will stop working.

Sergey Poznyakoff <gray>
Group administrator
Thu 12 May 2005 12:26:53 AM UTC, comment #2: 

However it applies without cpio-2.6-alt-error-details.patch, too.

Dmitry V. Levin <ldv>
Thu 12 May 2005 12:23:33 AM UTC, comment #1: 

Forgot to mention that attached patch is written for cpio-2.6 with
https://savannah. ... &item_id=4004 applied.

Dmitry V. Levin <ldv>
Wed 11 May 2005 11:16:34 PM UTC, original submission:  

By default, cpio creates absolute pathnames in copy-in and copy-pass modes which is insecure.
Also, cpio creates relative pathnames and this "feature" cannot be turned off.
As result, cpio could be tricked to overwrite arbitrary available file objects.

Dmitry V. Levin <ldv>

 

Attached Files

Attached Files
file #8821:  cpio-2.6-alt-safer_name_suffix.patch added by ldv (6.2KiB - proposed patch)

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

 

Votes

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

History

Follow 4 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-05-21 gray StatusPostponed Done
    Open/ClosedOpen Closed
2005-05-12 gray StatusNone Postponed
2005-05-11 ldv Attached File- Added cpio-2.6-alt-safer_name_suffix.patch, #4593

Back to the top

Powered by Savane 3.16-ed84.
Corresponding source code