Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

The remote NewStart CGSL host, running version MAIN 4.05, has tar packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in tar 1.14 through 1.15.90 allows user-     assisted attackers to cause a denial of service     (application crash) and possibly execute code via     unspecified vectors involving PAX extended headers.
    (CVE-2006-0300)

  - GNU tar 1.16 and 1.15.1, and possibly other versions,     allows user-assisted attackers to overwrite arbitrary     files via a tar file that contains a GNUTYPE_NAMES     record with a symbolic link, which is not properly     handled by the extract_archive function in extract.c and     extract_mangle function in mangle.c, a variant of     CVE-2002-1216. (CVE-2006-6097)

  - Directory traversal vulnerability in the     contains_dot_dot function in src/names.c in GNU tar     allows user-assisted remote attackers to overwrite     arbitrary files via certain //.. (slash slash dot dot)     sequences in directory symlinks in a TAR archive.
    (CVE-2007-4131)

  - Buffer overflow in the safer_name_suffix function in GNU     tar has unspecified attack vectors and impact, resulting     in a crashing stack. (CVE-2007-4476)

  - Heap-based buffer overflow in the rmt_read__ function in     lib/rtapelib.c in the rmt client functionality in GNU     tar before 1.23 and GNU cpio before 2.11 allows remote     rmt servers to cause a denial of service (memory     corruption) or possibly execute arbitrary code by     sending more data than was requested, related to archive     filenames that contain a : (colon) character.
    (CVE-2010-0624)

  - Directory traversal vulnerability in the     safer_name_suffix function in GNU tar 1.14 through 1.29     might allow remote attackers to bypass an intended     protection mechanism and write to arbitrary files via     vectors related to improper sanitization of the     file_name parameter, aka POINTYFEATHER. (CVE-2016-6321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has tar packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in tar 1.14 through 1.15.90 allows user-     assisted attackers to cause a denial of service     (application crash) and possibly execute code via     unspecified vectors involving PAX extended headers.
    (CVE-2006-0300)

  - GNU tar 1.16 and 1.15.1, and possibly other versions,     allows user-assisted attackers to overwrite arbitrary     files via a tar file that contains a GNUTYPE_NAMES     record with a symbolic link, which is not properly     handled by the extract_archive function in extract.c and     extract_mangle function in mangle.c, a variant of     CVE-2002-1216. (CVE-2006-6097)

  - Directory traversal vulnerability in the     contains_dot_dot function in src/names.c in GNU tar     allows user-assisted remote attackers to overwrite     arbitrary files via certain //.. (slash slash dot dot)     sequences in directory symlinks in a TAR archive.
    (CVE-2007-4131)

  - Buffer overflow in the safer_name_suffix function in GNU     tar has unspecified attack vectors and impact, resulting     in a crashing stack. (CVE-2007-4476)

  - Heap-based buffer overflow in the rmt_read__ function in     lib/rtapelib.c in the rmt client functionality in GNU     tar before 1.23 and GNU cpio before 2.11 allows remote     rmt servers to cause a denial of service (memory     corruption) or possibly execute arbitrary code by     sending more data than was requested, related to archive     filenames that contain a : (colon) character.
    (CVE-2010-0624)

  - Directory traversal vulnerability in the     safer_name_suffix function in GNU tar 1.14 through 1.29     might allow remote attackers to bypass an intended     protection mechanism and write to arbitrary files via     vectors related to improper sanitization of the     file_name parameter, aka POINTYFEATHER. (CVE-2016-6321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0860 :

Updated tar package that fixes a path traversal flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GNU tar program saves many files together in one archive and can restore individual files (or all of the files) from that archive.

A path traversal flaw was discovered in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar had write access.
(CVE-2007-4131)

Red Hat would like to thank Dmitry V. Levin for reporting this issue.

Users of tar should upgrade to this updated package, which contains a replacement backported patch to correct this issue.

A path traversal flaw was discovered in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar had write access.
(CVE-2007-4131)

This update fixes a directory traversal bug in tar. (CVE-2007-4131)

Several vulnerabilities have been discovered in GNU Tar. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-4131     A directory traversal vulnerability enables attackers     using specially crafted archives to extract contents     outside the directory tree created by tar.

  - CVE-2007-4476     A stack-based buffer overflow in the file name checking     code may lead to arbitrary code execution when     processing maliciously crafted archives.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

This update fixes a directory traversal bug in star. (CVE-2007-4131)

Dmitry V. Levin discovered that tar did not correctly detect the '..' file path element when unpacking archives. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary files could be overwritten with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Oct 24 2007 Radek Brich <rbrich at redhat.com>     2:1.15.1-28

    - backported upstream patch for CVE-2007-4476 (tar stack       crashing in safer_name_suffix)

  - Tue Aug 28 2007 Radek Brich <rbrich at redhat.com>     2:1.15.1-27

    - fixed CVE-2007-4131 tar directory traversal       vulnerability (#253684)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Aug 28 2007 Radek Brich <rbrich at redhat.com>     2:1.15.1-27

    - fixed CVE-2007-4131 tar directory traversal       vulnerability (#253684)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200709-09 (GNU Tar: Directory traversal vulnerability)

    Dmitry V. Levin discovered a directory traversal vulnerability in the     contains_dot_dot() function in file src/names.c.
  Impact :

    By enticing a user to extract a specially crafted tar archive, a remote     attacker could extract files to arbitrary locations outside of the     specified directory with the permissions of the user running GNU Tar.
  Workaround :

    There is no known workaround at this time.

Dmitry V. Levin discovered a path traversal flaw in how GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary fiels that the user running tar has write access to.

Updated packages have been patched to prevent these issues.

Red Hat reports :

A path traversal flaw was discovered in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar had write access.

Red Hat credits Dmitry V. Levin for reporting the issue.

Updated tar package that fixes a path traversal flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GNU tar program saves many files together in one archive and can restore individual files (or all of the files) from that archive.

A path traversal flaw was discovered in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar had write access.
(CVE-2007-4131)

Red Hat would like to thank Dmitry V. Levin for reporting this issue.

Users of tar should upgrade to this updated package, which contains a replacement backported patch to correct this issue.

ID	Name	Product	Family	Severity
127428	NewStart CGSL MAIN 4.05 : tar Multiple Vulnerabilities (NS-SA-2019-0153)	Nessus	NewStart CGSL Local Security Checks	high
127307	NewStart CGSL MAIN 4.06 : tar Multiple Vulnerabilities (NS-SA-2019-0089)	Nessus	NewStart CGSL Local Security Checks	high
67563	Oracle Linux 4 / 5 : tar (ELSA-2007-0860)	Nessus	Oracle Linux Local Security Checks	medium
60242	Scientific Linux Security Update : tar on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41149	SuSE9 Security Update : tar (YOU Patch Number 11723)	Nessus	SuSE Local Security Checks	medium
29805	Debian DSA-1438-1 : tar - several vulnerabilities	Nessus	Debian Local Security Checks	high
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
29586	SuSE 10 Security Update : tar (ZYPP Patch Number 4125)	Nessus	SuSE Local Security Checks	medium
29583	SuSE 10 Security Update : star (ZYPP Patch Number 4174)	Nessus	SuSE Local Security Checks	medium
28110	Ubuntu 6.06 LTS / 6.10 / 7.04 : tar vulnerability (USN-506-1)	Nessus	Ubuntu Local Security Checks	medium
27789	Fedora 7 : tar-1.15.1-28.fc7 (2007-2673)	Nessus	Fedora Local Security Checks	high
27740	Fedora 7 : tar-1.15.1-27.fc7 (2007-1890)	Nessus	Fedora Local Security Checks	medium
27464	openSUSE 10 Security Update : tar (tar-4124)	Nessus	SuSE Local Security Checks	medium
27459	openSUSE 10 Security Update : star (star-4173)	Nessus	SuSE Local Security Checks	medium
26099	GLSA-200709-09 : GNU Tar: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	medium
25983	Mandrake Linux Security Advisory : tar (MDKSA-2007:173)	Nessus	Mandriva Local Security Checks	medium
25967	FreeBSD : gtar -- Directory traversal vulnerability (d944719e-42f4-4864-89ed-f045b541919f)	Nessus	FreeBSD Local Security Checks	medium
25949	CentOS 4 / 5 : tar (CESA-2007:0860)	Nessus	CentOS Local Security Checks	medium
25948	RHEL 4 / 5 : tar (RHSA-2007:0860)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2007-4131

high

Tenable Plugins

high

high

medium

medium

medium

high

critical

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium