CVE-2010-4226 Path traversal in n/a
Remote attackers can overwrite arbitrary files via symlink manipulation in RPM archives using the cpio utility.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-4226?
CVE-2010-4226 is a high-severity path traversal vulnerability in Opensuse Opensuse, published on 6 Feb 2014. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive.
Weakness: CWE-59
Which versions are affected by CVE-2010-4226?
It affects 2 products.
Products include Gnu Cpio, Opensuse Opensuse.
How do I fix CVE-2010-4226?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2010-4226 being exploited?
There is no known exploitation of CVE-2010-4226 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as GHSA-mwc7-wm76-6x7w.