Bug 1318562 (CVE-2016-6321) - CVE-2016-6321 tar: Bypassing the extract path name
Summary: CVE-2016-6321 tar: Bypassing the extract path name
Status: CLOSED WONTFIX
Alias: CVE-2016-6321
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20161027,repor...
Keywords: Security
Depends On: 1389192
Blocks: 1318564
TreeView+ depends on / blocked
 
Reported: 2016-03-17 09:03 UTC by Adam Mariš
Modified: 2019-06-08 21:05 UTC (History)
6 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2019-06-08 02:49:49 UTC


Attachments (Terms of Use)

Description Adam Mariš 2016-03-17 09:03:30 UTC
It was found that GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line. GNU `tar' archiver attempts to avoid path traversal attacks by removing offending parts of the element name at extract. This sanitizing leads to a vulnerability where the attacker can bypass the path name(s) specified on the command line. The attacker can create a crafted tar archive that, if extracted by the victim, replaces files and directories the victim has access to in the target directory, regardless of the path name(s) specified on the command line.

External Reference:

https://sintonen.fi/advisories/tar-extract-pathname-bypass.txt

Comment 1 Adam Mariš 2016-03-17 09:03:34 UTC
Acknowledgments:

Name: Harry Sintonen

Comment 4 Stefan Cornelius 2016-04-05 12:23:10 UTC
Mitigation:

Use the "star" utility provided by the "star" package to process archives from untrusted sources.

Statement:

Red Hat Product Security has rated this issue as having Moderate security
impact, a future update may address this flaw. This issue did not affect the versions of star as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Comment 7 Andrej Nemec 2016-10-27 07:22:05 UTC
Created tar tracking bugs for this issue:

Affects: fedora-all [bug 1389192]

Comment 8 Andrej Nemec 2016-10-27 07:22:34 UTC
Public via:

http://seclists.org/fulldisclosure/2016/Oct/96

Comment 10 Andrej Nemec 2016-10-31 09:40:27 UTC
Patch for this issue has been updated according to the researcher:

http://seclists.org/fulldisclosure/2016/Oct/102


Note You need to log in before you can comment on or make changes to this bug.