Bug 7182

Summary: pigz, pax, cpio : directory traversal vulnerabilities, multiple CVEs
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Sona Sarmadi <sona.sarmadi>
Component: coreAssignee: Robert Yang <liezhi.yang>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium CC: liezhi.yang, meta.mr.watcher, meta.watcher
Version: unspecified   
Target Milestone: 1.8 M4   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Sona Sarmadi 2015-01-19 10:06:01 UTC 
Three cases of directory traversal in archiving utilities:

pigz, CVE-2015-1191
pigz is susceptible to directory traversal vulnerabilities. While 
decompressing a file with restoring file name, it (unlike gzip) will 
happily use absolute and relative paths taken from the input. This can 
be exploited by a malicious archive to write files outside the current 
directory.

Upstream  Fix:
 https://github.com/madler/pigz/commit/fdad1406b3ec809f4954ff7cdf9e99eb18c2458f

References:
https://bugs.debian.org/774978

===========================
pax, paxtar: directory traversal vulnerabilities CVE-2015-1193 & CVE-2015-1194

CVE-2015-1193 for the .. path traversal (CWE-22).
CVE-2015-1194 for the symlink following, which can allow access outside of the current directory.

References:
https://bugs.debian.org/774716
http://www.openwall.com/lists/oss-security/2015/01/07/5


CVE distinguishes symlink following from path traversal as different 
vulnerability types.  The fix for one issue is not necessarily guaranteed 
to fix the other.  Also, since symlink following attacks can often be used 
against protected files within a directory that is already accessible to 
the attacker, it might cause confusion to use the "directory traversal" 
term to describe them.
Comment 1 Sona Sarmadi 2015-01-19 12:37:06 UTC 
Additional directory traversal vulnerability via symlinks
cpio CVE-2015-1197

 Initial report:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669

 Upstream report:
 https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html

 Some discussion:
 http://www.openwall.com/lists/oss-security/2015/01/07/5
 http://www.openwall.com/lists/oss-security/2015/01/08/4
Comment 2 Robert Yang 2015-03-26 08:50:54 UTC 
pigz has been upgraded to 2.3.3, so it has been fixed.
Comment 3 Robert Yang 2015-04-01 01:34:42 UTC 
pax' problem is minor, and the patch for cpio has been merged.:

http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=3837f294227f8d12fd9d954bf1a44dd65b2df1e0