+++ This bug was initially created as a clone of Bug #295021 +++
Directory traversal vulnerability in Archive::Tar perl module allows
user-assisted remote attackers to overwrite arbitrary files writable by user
running application using this module via an absolute path or a .. (dot dot)
sequence in filenames in a TAR archive.
Similar issues were reported and fixed for GNU tar during past several years,
e.g.: CVE-2001-1267, CVE-2002-0399, CVE-2002-1216 and CVE-2007-4131.
This issue is important when this module is used to extract tar archives from
untrusted sources. However, some of such applications either implement
workarounds / own checks (sa-update in spamassassin) or dropped module support
at all (amavisd-new).
--- Additional comment from thoger on 2007-09-18 12:20:50 EDT ---
Similar issue was reported for Python's tarfile module, see #263261.
--- Additional comment from thoger on 2007-09-24 14:30:12 EDT ---
Upstream bug report:
http://rt.cpan.org/Public/Bug/Display.html?id=29517
--- Additional comment from lkundrak on 2007-11-09 12:49:41 EDT ---
Is there any chance this will get addressed for fedora?
--- Additional comment from robin.norwood on 2007-11-09 13:23:19 EDT ---
Once we have a fix for it, that fix will go into all supported versions of
fedora ASAP. We don't have a fix yet, though.
--- Additional comment from jpazdziora on 2008-03-05 09:25:11 EDT ---
The Archive::Tar 1.38 is now available on CPAN, with the following in CHANGES:
* important changes in vesrion 1.38 14/12/2007:
- Promote 1.37_01 to stable.
* important changes in version 1.37_01 11/11/2007:
_ Address #30380: directory traversal vulnerability in Archive-Tar
- Add $INSECURE_EXTRACT_MODE which defaults to 0, disallowing
archives to extract files outside of cwd(). This is a backwards
incompatible change from 1.36 and before.
- Add a -I option to ptar to enable insecure extraction if needed
So using this version in Fedoras seems like a way to to go. The diff from 1.34
(which we have in F8 and rawhide) and 1.36 is VMS specific, and diff from 1.36
to 1.38 is exactly fix for this bugzilla, so it should be safe to rebase.
Hmmm. Should I put this note to release-specific bugzillas?
--- Additional comment from thoger on 2008-03-05 10:53:28 EDT ---
Sadly, upstream version 1.38 is still prone to the directory traversal attack
using symlinks, as described in old Willy Tarreau's BugTraq post:
http://marc.info/?l=bugtraq&m=90674255917321
That problem was already pointed out in the upstream bug report.
--- Additional comment from jpazdziora on 2008-03-05 11:03:49 EDT ---
You are right. I should have said "diff from 1.36 to 1.38 is a partial fix for
this bugzilla and not other changes".
Is it better to wait for definitive fix, or close that one hole that 1.38
addresses, for the time being?
--- Additional comment from msuchy on 2008-03-19 09:46:10 EDT ---
See:
http://rt.cpan.org/Ticket/Display.html?id=30380#txn-436899
--- Additional comment from lkundrak on 2008-04-04 11:56:17 EDT ---
Maintainers; could you please punch upstream about this a bit? In case not, what
about applying Mirek's patch referred to in comment $11?
--- Additional comment from thoger on 2008-04-07 06:02:10 EDT ---
(In reply to comment #12)
> Maintainers; could you please punch upstream about this a bit? In case not, what
> about applying Mirek's patch referred to in comment $11?
Sorry, Mirek's patch does not resolve the issue.
--- Additional comment from tis on 2008-12-11 01:14:20 EDT ---
This should now be fixed upstream.
--- Additional comment from thoger on 2008-12-11 03:50:55 EDT ---
1.40 does following to cover known vectors:
- absolute paths are rejected
- all paths that include '..' as one of the elements are rejected
- extracting to symlink directories is denied
(applies to default SECURE EXTRACT MODE)
perl-Archive-Tar is now core perl module (as of perl 5.10 / F9, iirc), so Fedora updates will have to go via perl update.
--- Additional comment from tis on 2008-12-11 05:17:12 EDT ---
rhel5 is still vulnerable...
--- Additional comment from updates on 2008-12-22 08:25:02 EDT ---
perl-5.10.0-52.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/perl-5.10.0-52.fc10
--- Additional comment from updates on 2008-12-30 18:44:35 EDT ---
perl-5.10.0-52.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.