cve/2015/CVE-2015-1197.md

CVE-2015-1197

Description

cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.

POC

Reference

• http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Live-Hack-CVE/CVE-2015-1197
• https://github.com/Live-Hack-CVE/CVE-2017-7516
• https://github.com/fokypoky/places-list