CVE-2010-0624

What it actually does

Heap-based buffer overflow in rmt_read__ in lib/rtapelib.c allows remote rmt servers to corrupt memory or execute arbitrary code when an archive filename contains a colon and more data than requested is sent.

Why it matters to the business

Systems relying on affected archive tools for remote operations face risk of service disruption or full compromise; urgency is low given age and stable low exploit probability but organizations packaging older GNU tar or cpio must prioritize upgrades to avoid lingering exposure in build or backup pipelines.

How an attack unfolds

An attacker hosts a malicious rmt server and induces a vulnerable client (tar or cpio) to connect using an archive path containing a colon; the server then responds with excess data that overflows the heap buffer in rmt_read__, enabling memory corruption or code execution.

How to fix it

Upgrade GNU tar to 1.23 or later and GNU cpio to 2.11 or later. For listed packages apply the exact fixed versions: logstash-jre-bcfips to 8.12.2-r1, logstash-jre-bcfips-compat to 8.12.2-r1, logstash-jre-bcfips-env2yaml to 8.12.2-r1, and logstash-jre-bcfips-with-output-opensearch to 8.12.2-r1. Disable remote rmt functionality where unnecessary.

How to confirm the fix worked

Confirm tar version >=1.23 and cpio >=2.11 via --version output; verify package manifests report the listed fixed versions; test archive operations with colon-containing names against a controlled rmt endpoint.

Typical attack path

1. Identify or coerce use of tar/cpio with remote rmt via archive name containing ':'
2. Position malicious rmt server to receive the connection
3. Send oversized response exceeding requested data length
4. Trigger heap overflow leading to denial of service or arbitrary code execution

How to detect it

Search process execution logs and command history for tar or cpio invocations referencing rmt or colon-containing paths; inspect core dumps or memory corruption indicators from archive operations; review network traffic to unexpected rmt ports.

What your security team should do

• Immediately inventory all systems for GNU tar <1.23 or cpio <2.11 and schedule upgrades
• Apply the precise package fixes provided for the affected distributions
• Review backup and build scripts for rmt usage and restrict to trusted servers only
• Monitor EPSS and exploit availability for any change in risk posture