Full Disclosure mailing list archives

On Tue, 9 Jan 2024, Georgi Guninski wrote:

On Tue, Jan 9, 2024 at 12:45 AM Harry Sintonen <harry () sintonen fi> wrote:

On Mon, 8 Jan 2024, Georgi Guninski wrote:

When extracting archives cpio (at least version 2.13) preserves
the setuid flag, which might lead to privilege escalation.

So does for example tar. The same rules that apply to tar also apply to
cpio:

Which version of tar is vulnerable to this attack?

Tar does set setuid bit, but tar is not vulnerable. This is not an attack.

https://www.gnu.org/software/tar/manual/html_section/Security.html#Security-rules-of-thumb

These same security considerations also apply to cpio.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• cpio privilege escalation vulnerability via setuid files in cpio archive Georgi Guninski (Jan 08)
  • Re: cpio privilege escalation vulnerability via setuid files in cpio archive fulldisclosure (Jan 14)
  • Re: cpio privilege escalation vulnerability via setuid files in cpio archive Harry Sintonen via Fulldisclosure (Jan 14)
    • Re: cpio privilege escalation vulnerability via setuid files in cpio archive Georgi Guninski (Jan 14)
      • Re: cpio privilege escalation vulnerability via setuid files in cpio archive Harry Sintonen via Fulldisclosure (Jan 14)