Bug 1155199 - (CVE-2019-14866) VUL-0: CVE-2019-14866: cpio: improper input validation when writing tar header fields leads to unexpect tar generation
(CVE-2019-14866)
VUL-0: CVE-2019-14866: cpio: improper input validation when writing tar heade...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/245793/
CVSSv3:SUSE:CVE-2019-14866:5.1:(AV:L/...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-10-28 11:56 UTC by Marcus Meissner
Modified: 2020-07-10 13:44 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2019-10-28 11:56:34 UTC
from rh bugzilla

cpio does not properly validate the values written in the header of a TAR file through the to_oct() function. When creating a TAR file from a list of files and one of those is another TAR file with a big size, cpio will generate the resulting file with the content extracted from the input one. This leads to unexpected results as the newly generated TAR file could have files with permissions the owner of the input TAR file did not have or in paths he did not have access to.

References:
https://lists.gnu.org/archive/html/bug-cpio/2019-08/msg00003.html

Proposed patch:
https://cement.retrofitta.se/tmp/cpio-tar.patch
Comment 4 Swamp Workflow Management 2019-11-08 09:49:25 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2019-11-22.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64396
Comment 5 Swamp Workflow Management 2019-11-25 20:22:31 UTC
SUSE-SU-2019:3059-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1155199
CVE References: CVE-2019-14866
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    cpio-2.12-3.3.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    cpio-2.12-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2019-11-25 23:11:34 UTC
SUSE-SU-2019:3064-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1155199
CVE References: CVE-2019-14866
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    cpio-2.11-36.6.1
SUSE Linux Enterprise Server 12-SP4 (src):    cpio-2.11-36.6.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    cpio-2.11-36.6.1
SUSE CaaS Platform 3.0 (src):    cpio-2.11-36.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2019-11-30 23:11:05 UTC
openSUSE-SU-2019:2593-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1155199
CVE References: CVE-2019-14866
Sources used:
openSUSE Leap 15.0 (src):    cpio-2.12-lp150.2.3.1
Comment 8 Swamp Workflow Management 2019-11-30 23:11:43 UTC
openSUSE-SU-2019:2596-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1155199
CVE References: CVE-2019-14866
Sources used:
openSUSE Leap 15.1 (src):    cpio-2.12-lp151.3.3.1
Comment 9 Alexandros Toptsoglou 2020-07-10 13:44:50 UTC
Done