Buffer overflow in tar 1.14 through 1.15.90 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute code via unspecified vectors involving PAX extended headers.

The remote NewStart CGSL host, running version MAIN 4.05, has tar packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in tar 1.14 through 1.15.90 allows user-     assisted attackers to cause a denial of service     (application crash) and possibly execute code via     unspecified vectors involving PAX extended headers.
    (CVE-2006-0300)

  - GNU tar 1.16 and 1.15.1, and possibly other versions,     allows user-assisted attackers to overwrite arbitrary     files via a tar file that contains a GNUTYPE_NAMES     record with a symbolic link, which is not properly     handled by the extract_archive function in extract.c and     extract_mangle function in mangle.c, a variant of     CVE-2002-1216. (CVE-2006-6097)

  - Directory traversal vulnerability in the     contains_dot_dot function in src/names.c in GNU tar     allows user-assisted remote attackers to overwrite     arbitrary files via certain //.. (slash slash dot dot)     sequences in directory symlinks in a TAR archive.
    (CVE-2007-4131)

  - Buffer overflow in the safer_name_suffix function in GNU     tar has unspecified attack vectors and impact, resulting     in a crashing stack. (CVE-2007-4476)

  - Heap-based buffer overflow in the rmt_read__ function in     lib/rtapelib.c in the rmt client functionality in GNU     tar before 1.23 and GNU cpio before 2.11 allows remote     rmt servers to cause a denial of service (memory     corruption) or possibly execute arbitrary code by     sending more data than was requested, related to archive     filenames that contain a : (colon) character.
    (CVE-2010-0624)

  - Directory traversal vulnerability in the     safer_name_suffix function in GNU tar 1.14 through 1.29     might allow remote attackers to bypass an intended     protection mechanism and write to arbitrary files via     vectors related to improper sanitization of the     file_name parameter, aka POINTYFEATHER. (CVE-2016-6321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has tar packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in tar 1.14 through 1.15.90 allows user-     assisted attackers to cause a denial of service     (application crash) and possibly execute code via     unspecified vectors involving PAX extended headers.
    (CVE-2006-0300)

  - GNU tar 1.16 and 1.15.1, and possibly other versions,     allows user-assisted attackers to overwrite arbitrary     files via a tar file that contains a GNUTYPE_NAMES     record with a symbolic link, which is not properly     handled by the extract_archive function in extract.c and     extract_mangle function in mangle.c, a variant of     CVE-2002-1216. (CVE-2006-6097)

  - Directory traversal vulnerability in the     contains_dot_dot function in src/names.c in GNU tar     allows user-assisted remote attackers to overwrite     arbitrary files via certain //.. (slash slash dot dot)     sequences in directory symlinks in a TAR archive.
    (CVE-2007-4131)

  - Buffer overflow in the safer_name_suffix function in GNU     tar has unspecified attack vectors and impact, resulting     in a crashing stack. (CVE-2007-4476)

  - Heap-based buffer overflow in the rmt_read__ function in     lib/rtapelib.c in the rmt client functionality in GNU     tar before 1.23 and GNU cpio before 2.11 allows remote     rmt servers to cause a denial of service (memory     corruption) or possibly execute arbitrary code by     sending more data than was requested, related to archive     filenames that contain a : (colon) character.
    (CVE-2010-0624)

  - Directory traversal vulnerability in the     safer_name_suffix function in GNU tar 1.14 through 1.29     might allow remote attackers to bypass an intended     protection mechanism and write to arbitrary files via     vectors related to improper sanitization of the     file_name parameter, aka POINTYFEATHER. (CVE-2016-6321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SunOS 5.10_x86: gtar patch.
Date this patch was last updated by Sun : Jul/16/18

SunOS 5.10: gtar patch.
Date this patch was last updated by Sun : Jul/16/18

SunOS 5.10_x86: gtar patch.
Date this patch was last updated by Sun : Apr/19/10

SunOS 5.10: gtar patch.
Date this patch was last updated by Sun : Apr/19/10

SunOS 5.9_x86: gtar patch.
Date this patch was last updated by Sun : Apr/19/10

SunOS 5.9: gtar patch.
Date this patch was last updated by Sun : Apr/19/10

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2007-004 applied.

This update fixes security flaws in the following applications :

AFP Client AirPort CarbonCore diskdev_cmds fetchmail ftpd gnutar Help Viewer HID Family Installer Kerberos Libinfo Login Window network_cmds SMB System Configuration URLMount Video Conference WebDAV

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.9 or a version of Mac OS X 10.3 that does not have Security Update 2007-003 applied. This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.9 or a version of Mac OS X 10.3 which does not have Security Update 2007-003 applied.

This update contains several security fixes for the following programs :

 - ColorSync
 - CoreGraphics
 - Crash Reporter
 - CUPS
 - Disk Images
 - DS Plugins
 - Flash Player
 - GNU Tar
 - HFS
 - HID Family
 - ImageIO
 - Kernel
 - MySQL server
 - Networking
 - OpenSSH
 - Printing
 - QuickDraw Manager
 - servermgrd
 - SMB File Server
 - Software Update
 - sudo 
 - WebLog

Jim Meyering discovered several buffer overflows in GNU tar, which may lead to the execution of arbitrary code through specially crafted tar archives.

An updated tar package that fixes a buffer overflow bug is now available for Red Hat Enterprise Linux 4.

This update has been rated as having Moderate security impact by the Red Hat Security Response Team.

The GNU tar program saves many files together in one archive and can restore individual files (or all of the files) from that archive.

Jim Meyering discovered a buffer overflow bug in the way GNU tar extracts malformed archives. By tricking a user into extracting a malicious tar archive, it is possible to execute arbitrary code as the user running tar. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-0300 to this issue.

Users of tar should upgrade to this updated package, which contains a backported patch to correct this issue.

GNU tar is vulnerable to a buffer overflow, caused by improper bounds checking of the PAX extended headers. By tricking an user into processing a specially crafted tar archive, this could be exploited to execute arbitrary code with the privileges of the user.

Jim Meyering discovered that tar did not properly verify the validity of certain header fields in a GNU tar archive. By tricking an user into processing a specially crafted tar archive, this could be exploited to execute arbitrary code with the privileges of the user.

The tar version in Ubuntu 4.10 is not affected by this vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200603-06 (GNU tar: Buffer overflow)

    Jim Meyering discovered a flaw in the handling of certain header     fields that could result in a buffer overflow when extracting or     listing the contents of an archive.
  Impact :

    A remote attacker could construct a malicious tar archive that     could potentially execute arbitrary code with the privileges of the     user running GNU tar.
  Workaround :

    There is no known workaround at this time.

Gnu tar versions 1.14 and above have a buffer overflow vulnerability and some other issues including :

  - Carefully crafted invalid headers can cause buffer     overrun.

    - Invalid header fields go undiagnosed.

    - Some valid time strings are ignored.

The updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
127428	NewStart CGSL MAIN 4.05 : tar Multiple Vulnerabilities (NS-SA-2019-0153)	Nessus	NewStart CGSL Local Security Checks	high
127307	NewStart CGSL MAIN 4.06 : tar Multiple Vulnerabilities (NS-SA-2019-0089)	Nessus	NewStart CGSL Local Security Checks	high
111125	Solaris 10 (x86) : 139100-07	Nessus	Solaris Local Security Checks	medium
111115	Solaris 10 (sparc) : 139099-07	Nessus	Solaris Local Security Checks	medium
108007	Solaris 10 (x86) : 139100-04	Nessus	Solaris Local Security Checks	medium
107509	Solaris 10 (sparc) : 139099-04	Nessus	Solaris Local Security Checks	medium
35001	Solaris 9 (x86) : 118192-05	Nessus	Solaris Local Security Checks	medium
34997	Solaris 9 (sparc) : 118191-05	Nessus	Solaris Local Security Checks	medium
25081	Mac OS X Multiple Vulnerabilities (Security Update 2007-004)	Nessus	MacOS X Local Security Checks	critical
3947	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus Network Monitor	Web Clients	high
24811	Mac OS X < 10.4.9 Multiple Vulnerabilities (Security Update 2007-003)	Nessus	MacOS X Local Security Checks	critical
22853	Debian DSA-987-1 : tar - buffer overflow	Nessus	Debian Local Security Checks	medium
21988	CentOS 4 : tar (CESA-2006:0232)	Nessus	CentOS Local Security Checks	medium
21437	FreeBSD : gtar -- invalid headers buffer overflow (6107efb9-aae3-11da-aea1-000854d03344)	Nessus	FreeBSD Local Security Checks	medium
21065	Ubuntu 5.04 / 5.10 : tar vulnerability (USN-257-1)	Nessus	Ubuntu Local Security Checks	medium
21044	GLSA-200603-06 : GNU tar: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
21005	RHEL 4 : tar (RHSA-2006:0232)	Nessus	Red Hat Local Security Checks	medium
20964	Mandrake Linux Security Advisory : tar (MDKSA-2006:046)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2006-0300

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

critical

high

critical

medium

medium

medium

medium

medium

medium

medium