On Tue, 9 Jan 2024, Georgi Guninski wrote:
On Tue, Jan 9, 2024 at 12:45 AM Harry Sintonen <harry@xxxxxxxxxxx> wrote:On Mon, 8 Jan 2024, Georgi Guninski wrote:When extracting archives cpio (at least version 2.13) preserves the setuid flag, which might lead to privilege escalation.So does for example tar. The same rules that apply to tar also apply to cpio:Which version of tar is vulnerable to this attack?
Tar does set setuid bit, but tar is not vulnerable. This is not an attack.The user is responsible for extracting the archives to secure location and not letting other users access to insecure setuid binaries. See:
https://www.gnu.org/software/tar/manual/html_section/Security.html#Security-rules-of-thumb These same security considerations also apply to cpio. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/