4.7
CVSSv3

CVE-2005-1111

Published: 02/05/2005 Updated: 26/01/2024
CVSS v2 Base Score: 3.7 | Impact Score: 6.4 | Exploitability Score: 1.9
CVSS v3 Base Score: 4.7 | Impact Score: 3.6 | Exploitability Score: 1
VMScore: 329
Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P

Vulnerability Summary

Race condition in cpio 2.6 and previous versions allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by cpio after the decompression is complete.

Vulnerable Product Search on Vulmon Subscribe to Product

gnu cpio

debian debian linux 3.1

debian debian linux 3.0

canonical ubuntu linux 4.10

canonical ubuntu linux 5.04

Vendor Advisories

Imran Ghory found a race condition in the handling of output files While a file was unpacked with cpio, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the cpio user (CAN-2005-1111) ...
Synopsis cpio security update Type/Severity Security Advisory: Low Topic An updated cpio package that fixes multiple issues is now availableThis update has been rated as having low security impact by the Red HatSecurity Response Team Description GNU cpio copies files into or out of a cpio ...
Synopsis cpio security update Type/Severity Security Advisory: Low Topic An updated cpio package that fixes multiple issues is now availableThis update has been rated as having low security impact by the Red HatSecurity Response Team Description GNU cpio copies files into or out of a cpio ...
Two vulnerabilities have been discovered in cpio, a program to manage archives of files The Common Vulnerabilities and Exposures project identifies the following problems: CAN-2005-1111 Imran Ghory discovered a race condition in setting the file permissions of files extracted from cpio archives A local attacker with write access to t ...