Bug 1318562 (CVE-2016-6321)

Summary: CVE-2016-6321 tar: Bypassing the extract path name
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: carnil, praiskup, sardella, scorneli, security-response-team, sgrubb, slawomir
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:49:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1389192    
Bug Blocks: 1318564    

Description Adam Mariš 2016-03-17 09:03:30 UTC 
It was found that GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line. GNU `tar' archiver attempts to avoid path traversal attacks by removing offending parts of the element name at extract. This sanitizing leads to a vulnerability where the attacker can bypass the path name(s) specified on the command line. The attacker can create a crafted tar archive that, if extracted by the victim, replaces files and directories the victim has access to in the target directory, regardless of the path name(s) specified on the command line.

External Reference:

https://sintonen.fi/advisories/tar-extract-pathname-bypass.txt
Comment 1 Adam Mariš 2016-03-17 09:03:34 UTC 
Acknowledgments:

Name: Harry Sintonen
Comment 4 Stefan Cornelius 2016-04-05 12:23:10 UTC 
Mitigation:

Use the "star" utility provided by the "star" package to process archives from untrusted sources.

Statement:

Red Hat Product Security has rated this issue as having Moderate security
impact, a future update may address this flaw. This issue did not affect the versions of star as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Comment 7 Andrej Nemec 2016-10-27 07:22:05 UTC 
Created tar tracking bugs for this issue:

Affects: fedora-all [bug 1389192]
Comment 8 Andrej Nemec 2016-10-27 07:22:34 UTC 
Public via:

http://seclists.org/fulldisclosure/2016/Oct/96
Comment 10 Andrej Nemec 2016-10-31 09:40:27 UTC 
Patch for this issue has been updated according to the researcher:

http://seclists.org/fulldisclosure/2016/Oct/102