libtar was found to have a flaw where it does not validate the file names stored inside a tar file, which could possibly lead to a file extraction outside the prefix path. The functions "tar_extract_glob" and "tar_extract_all" accept a path prefix on where to extract files to, but libtar doesn't validate the file names inside the tar file. For example: consider a file name "../../etc/passwd". If extract_all is called with prefix "/home/USER/", libtar would try to overwrite "/etc/passwd". There is a workaround where a user could validate all filenames inside tar archive before calling tar_extract_*, but it seems that most of the users don't do that, so it's better that libtar should itself validate the file names. References: http://seclists.org/oss-sec/2013/q4/69 https://lists.feep.net:8080/pipermail/libtar/2013-October/000362.html
Created libtar tracking bugs for this issue: Affects: fedora-all [bug 1018151] Affects: epel-5 [bug 1018152]
Statement: This issue affects the version of libtar as shipped with Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2013-4420