[arch-security] [ASA-201611-11] tar: arbitrary file overwrite

[Levente Polyak]

Arch Linux Security Advisory ASA-201611-11
==========================================

Severity: Medium
Date    : 2016-11-03
CVE-ID  : CVE-2016-6321
Package : tar
Type    : arbitrary file overwrite
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package tar before version 1.29-2 is vulnerable to arbitrary file
overwrite.

Resolution
==========

Upgrade to 1.29-2.

# pacman -Syu "tar>=1.29-2"

The problem has been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

The GNU tar archiver attempts to avoid path traversal attacks by
removing offending parts of the element name at extract. This
sanitizing leads to a vulnerability where the attacker can bypass the
path name(s) specified on the command line leading to arbitrary
overwrite of files and directories inside the target directory.

Impact
======

A remote attacker is able to use a specially crafted tar archive that,
when extracted by the victim, replaces files and directories regardless
of the path name(s) specified.

References
==========

https://bugs.archlinux.org/task/51563
http://seclists.org/fulldisclosure/2016/Oct/96
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea053
https://sintonen.fi/advisories/tar-extract-pathname-bypass.txt
https://access.redhat.com/security/cve/CVE-2016-6321

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20161103/f987b169/attachment.asc>