Red Hat Bugzilla – Bug 1318562
CVE-2016-6321 tar: Bypassing the extract path name
Last modified: 2017-03-09 19:41:30 EST
It was found that GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line. GNU `tar' archiver attempts to avoid path traversal attacks by removing offending parts of the element name at extract. This sanitizing leads to a vulnerability where the attacker can bypass the path name(s) specified on the command line. The attacker can create a crafted tar archive that, if extracted by the victim, replaces files and directories the victim has access to in the target directory, regardless of the path name(s) specified on the command line. External Reference: https://sintonen.fi/advisories/tar-extract-pathname-bypass.txt
Acknowledgments: Name: Harry Sintonen
Mitigation: Use the "star" utility provided by the "star" package to process archives from untrusted sources. Statement: Red Hat Product Security has rated this issue as having Moderate security impact, a future update may address this flaw. This issue did not affect the versions of star as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Created tar tracking bugs for this issue: Affects: fedora-all [bug 1389192]
Public via: http://seclists.org/fulldisclosure/2016/Oct/96
Patch for this issue has been updated according to the researcher: http://seclists.org/fulldisclosure/2016/Oct/102