Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

The remote NewStart CGSL host, running version MAIN 4.05, has tar packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in tar 1.14 through 1.15.90 allows user-     assisted attackers to cause a denial of service     (application crash) and possibly execute code via     unspecified vectors involving PAX extended headers.
    (CVE-2006-0300)

  - GNU tar 1.16 and 1.15.1, and possibly other versions,     allows user-assisted attackers to overwrite arbitrary     files via a tar file that contains a GNUTYPE_NAMES     record with a symbolic link, which is not properly     handled by the extract_archive function in extract.c and     extract_mangle function in mangle.c, a variant of     CVE-2002-1216. (CVE-2006-6097)

  - Directory traversal vulnerability in the     contains_dot_dot function in src/names.c in GNU tar     allows user-assisted remote attackers to overwrite     arbitrary files via certain //.. (slash slash dot dot)     sequences in directory symlinks in a TAR archive.
    (CVE-2007-4131)

  - Buffer overflow in the safer_name_suffix function in GNU     tar has unspecified attack vectors and impact, resulting     in a crashing stack. (CVE-2007-4476)

  - Heap-based buffer overflow in the rmt_read__ function in     lib/rtapelib.c in the rmt client functionality in GNU     tar before 1.23 and GNU cpio before 2.11 allows remote     rmt servers to cause a denial of service (memory     corruption) or possibly execute arbitrary code by     sending more data than was requested, related to archive     filenames that contain a : (colon) character.
    (CVE-2010-0624)

  - Directory traversal vulnerability in the     safer_name_suffix function in GNU tar 1.14 through 1.29     might allow remote attackers to bypass an intended     protection mechanism and write to arbitrary files via     vectors related to improper sanitization of the     file_name parameter, aka POINTYFEATHER. (CVE-2016-6321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has tar packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in tar 1.14 through 1.15.90 allows user-     assisted attackers to cause a denial of service     (application crash) and possibly execute code via     unspecified vectors involving PAX extended headers.
    (CVE-2006-0300)

  - GNU tar 1.16 and 1.15.1, and possibly other versions,     allows user-assisted attackers to overwrite arbitrary     files via a tar file that contains a GNUTYPE_NAMES     record with a symbolic link, which is not properly     handled by the extract_archive function in extract.c and     extract_mangle function in mangle.c, a variant of     CVE-2002-1216. (CVE-2006-6097)

  - Directory traversal vulnerability in the     contains_dot_dot function in src/names.c in GNU tar     allows user-assisted remote attackers to overwrite     arbitrary files via certain //.. (slash slash dot dot)     sequences in directory symlinks in a TAR archive.
    (CVE-2007-4131)

  - Buffer overflow in the safer_name_suffix function in GNU     tar has unspecified attack vectors and impact, resulting     in a crashing stack. (CVE-2007-4476)

  - Heap-based buffer overflow in the rmt_read__ function in     lib/rtapelib.c in the rmt client functionality in GNU     tar before 1.23 and GNU cpio before 2.11 allows remote     rmt servers to cause a denial of service (memory     corruption) or possibly execute arbitrary code by     sending more data than was requested, related to archive     filenames that contain a : (colon) character.
    (CVE-2010-0624)

  - Directory traversal vulnerability in the     safer_name_suffix function in GNU tar 1.14 through 1.29     might allow remote attackers to bypass an intended     protection mechanism and write to arbitrary files via     vectors related to improper sanitization of the     file_name parameter, aka POINTYFEATHER. (CVE-2016-6321)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - GNU cpio
  - GNU cpio on 64-bit
  - GNU tar
  - Kerberos 5
  - Perl
  - PostgreSQL
  - Safe Module for Perl Automagic Methods
  - Samba smbd

From Red Hat Security Advisory 2010:0144 :

An updated cpio package that fixes two security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

Red Hat would like to thank Jakob Lell for responsibly reporting the CVE-2010-0624 issue.

A denial of service flaw was found in the way cpio expanded archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. (CVE-2007-4476)

Users of cpio are advised to upgrade to this updated package, which contains backported patches to correct these issues.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2010-0141 advisory.

    - CVE-2007-4476 - fix stack crashing in safer_name_suffix

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2007-4476 tar/cpio stack crashing in safer_name_suffix

CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive

A heap-based buffer overflow flaw was found in the way tar expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the tar executable to crash or execute arbitrary code with the privileges of the user running tar.
(CVE-2010-0624)

A denial of service flaw was found in the way tar expanded archive files. If a user expanded a specially crafted archive, it could cause the tar executable to crash. (CVE-2007-4476) - SL4 and SL5 Only

CVE-2005-4268 cpio large filesize buffer overflow

CVE-2007-4476 tar/cpio stack crashing in safer_name_suffix

CVE-2010-0624 tar, cpio: Heap-based buffer overflow by expanding a specially crafted archive

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

A stack-based buffer overflow flaw was found in the way cpio expanded large archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. This issue only affected 64-bit platforms. (CVE-2005-4268) - SL3 Only

A denial of service flaw was found in the way cpio expanded archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. (CVE-2007-4476) - SL5 Only

a. Service Console update for cpio

   The service console package cpio is updated to version 2.5-6.RHEL3    for ESX 3.x versions and updated to version 2.6-23.el5_4.1 for    ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2005-4268 and CVE-2010-0624 to the issues    addressed in the update for ESX 3.x and the names CVE-2007-4476 and    CVE-2010-0624 to the issues addressed in the update for ESX 4.x.

b. Service Console update for tar

   The service console package tar is updated to version    1.13.25-16.RHEL3 for ESX 3.x versions and updated to version    1.15.1-23.0.1.el5_4.2 for ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0624 to the issue addressed in the    update for ESX 3.x and the names CVE-2007-4476 and CVE-2010-0624    to the issues addressed in the update for ESX 4.x.

c. Service Console update for samba

   The service console packages for samba are updated to version    samba-3.0.9-1.3E.17vmw, samba-client-3.0.9-1.3E.17vmw and    samba-common-3.0.9-1.3E.17vmw.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2063 to the issue addressed in this    update.

   Note :
   The issue mentioned above is present in the Samba server (smbd) and    is not present in the Samba client or Samba common packages.

   To determine if your system has Samba server installed do a    'rpm -q samba`.

   The following lists when the Samba server is installed on the ESX    service console :

   - ESX 4.0, ESX 4.1      The Samba server is not present on ESX 4.0 and ESX 4.1.

   - ESX 3.5      The Samba server is present if an earlier patch for Samba has been      installed.

   - ESX 3.0.3      The Samba server is present if ESX 3.0.3 was upgraded from an      earlier version of ESX 3 and a Samba patch was installed on that      version.

   The Samba server is not needed to operate the service console and    can be be disabled without loss of functionality to the service    console.

d. Service Console update for krb5

   The service console package krb5 is updated to version 1.2.7-72    for ESX 3.x versions and to version 1.6.1-36.el5_5.4 for ESX 4.x    versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-1321 to the issue addressed in    these updates.

e. Service Console update for perl

   The service console package perl is updated to version    5.8.0-101.EL3 for ESX 3.x versions and version 5.8.8-32.el5_5.1    for ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1168 and CVE-2010-1447 to the issues    addressed in the update for ESX 3.x and the names CVE-2008-5302,    CVE-2008-5303, CVE-2010-1168, and CVE-2010-1447 to the issues    addressed in the update for ESX 4.x.

An updated cpio package that fixes two security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A heap-based buffer overflow flaw was found in the way cpio expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the cpio executable to crash or execute arbitrary code with the privileges of the user running cpio.
(CVE-2010-0624)

Red Hat would like to thank Jakob Lell for responsibly reporting the CVE-2010-0624 issue.

A denial of service flaw was found in the way cpio expanded archive files. If a user expanded a specially crafted archive, it could cause the cpio executable to crash. (CVE-2007-4476)

Users of cpio are advised to upgrade to this updated package, which contains backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0141 advisory.

  - tar/cpio stack crashing in safer_name_suffix (CVE-2007-4476)

  - tar, cpio: Heap-based buffer overflow by expanding a specially-crafted archive (CVE-2010-0624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated tar package that fixes two security issues is now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GNU tar program saves many files together in one archive and can restore individual files (or all of the files) from that archive.

A heap-based buffer overflow flaw was found in the way tar expanded archive files. If a user were tricked into expanding a specially crafted archive, it could cause the tar executable to crash or execute arbitrary code with the privileges of the user running tar.
(CVE-2010-0624)

Red Hat would like to thank Jakob Lell for responsibly reporting the CVE-2010-0624 issue.

A denial of service flaw was found in the way tar expanded archive files. If a user expanded a specially crafted archive, it could cause the tar executable to crash. (CVE-2007-4476)

Users of tar are advised to upgrade to this updated package, which contains backported patches to correct these issues.

Dmitry V. Levin discovered a buffer overflow in tar. If a user or automated system were tricked into opening a specially crafted tar file, an attacker could crash tar or possibly execute arbitrary code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was discovered in cpio. If a user were tricked into opening a crafted cpio archive, an attacker could cause a denial of service via application crash, or possibly execute code with the privileges of the user invoking the program. (CVE-2007-4476).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SecurityFocus reports :

GNUs tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the alloca() function.

Successfully exploiting this issue allows attackers to crash the affected utilities and possibly to execute code but this has not been confirmed.

Dmitry Levin discovered a vulnerability in path handling code used by the cpio archive utility. The weakness could enable a denial of service (crash) or potentially the execution of arbitrary code if a vulnerable version of cpio is used to extract or to list the contents of a maliciously crafted archive.

Several vulnerabilities have been discovered in GNU Tar. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-4131     A directory traversal vulnerability enables attackers     using specially crafted archives to extract contents     outside the directory tree created by tar.

  - CVE-2007-4476     A stack-based buffer overflow in the file name checking     code may lead to arbitrary code execution when     processing maliciously crafted archives.

This update fixes a bug in function safer_name_suffix() of cpio which leads to a crashing stack. Exploitability is unknown. (CVE-2007-4476)

Buffer overflow in the safer_name_suffix function in GNU cpio has unspecified attack vectors and impact, resulting in a crashing stack.
This problem is originally found in tar, but affects cpio too, due to similar code fragments. (CVE-2007-4476)

Directory traversal vulnerability in cpio 2.6 and earlier allows remote attackers to write to arbitrary directories via a .. (dot dot) in a cpio file. This is an old issue, affecting only Mandriva Corporate Server 4 and Mandriva Linux 2007. (CVE-2005-1229)

Updated package fixes these issues.

The remote host is affected by the vulnerability described in GLSA-200711-18 (Cpio: Buffer overflow)

    A buffer overflow vulnerability in the safer_name_suffix() function in     GNU cpio has been discovered.
  Impact :

    A remote attacker could entice a user to open a specially crafted     archive file resulting in a stack-based buffer overflow, possibly     crashing the application. It is disputed whether the execution of     arbitrary code is possible.
  Workaround :

    There is no known workaround at this time.

- Thu Nov 1 2007 Radek Brich <rbrich at redhat.com> 2.9-5

    - upstream patch for CVE-2007-4476 (stack crashing in       safer_name_suffix)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Oct 24 2007 Radek Brich <rbrich at redhat.com>     2:1.17-4

    - upstream patch for CVE-2007-4476 (tar stack crashing       in safer_name_suffix)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Nov 2 2007 Radek Brich <rbrich at redhat.com> 2.6-28

    - patch for CVE-2007-4476 (stack crashing in       safer_name_suffix)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Oct 24 2007 Radek Brich <rbrich at redhat.com>     2:1.15.1-28

    - backported upstream patch for CVE-2007-4476 (tar stack       crashing in safer_name_suffix)

  - Tue Aug 28 2007 Radek Brich <rbrich at redhat.com>     2:1.15.1-27

    - fixed CVE-2007-4131 tar directory traversal       vulnerability (#253684)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Oct 24 2007 Radek Brich <rbrich at redhat.com>     2:1.15.1-27

    - backported upstream patch for CVE-2007-4476 (tar stack       crashing in safer_name_suffix)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in GNU tar has unspecified attack vectors and impact, resulting in a crashing stack.

Updated packages fix this issue.

ID	Name	Product	Family	Severity
127428	NewStart CGSL MAIN 4.05 : tar Multiple Vulnerabilities (NS-SA-2019-0153)	Nessus	NewStart CGSL Local Security Checks	high
127307	NewStart CGSL MAIN 4.06 : tar Multiple Vulnerabilities (NS-SA-2019-0089)	Nessus	NewStart CGSL Local Security Checks	high
89741	VMware ESX Multiple Vulnerabilities (VMSA-2010-0013) (remote check)	Nessus	VMware ESX Local Security Checks	high
68011	Oracle Linux 5 : cpio (ELSA-2010-0144)	Nessus	Oracle Linux Local Security Checks	high
68008	Oracle Linux 5 : tar (ELSA-2010-0141)	Nessus	Oracle Linux Local Security Checks	critical
60747	Scientific Linux Security Update : tar on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60745	Scientific Linux Security Update : cpio on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
49085	VMSA-2010-0013 : VMware ESX third-party updates for Service Console	Nessus	VMware ESX Local Security Checks	high
46267	RHEL 5 : cpio (RHSA-2010:0144)	Nessus	Red Hat Local Security Checks	high
46264	RHEL 4 / 5 : tar (RHSA-2010:0141)	Nessus	Red Hat Local Security Checks	critical
45068	CentOS 5 : cpio (CESA-2010:0144)	Nessus	CentOS Local Security Checks	high
45067	CentOS 4 / 5 : tar (CESA-2010:0141)	Nessus	CentOS Local Security Checks	high
36397	Ubuntu 6.06 LTS / 7.10 : tar vulnerability (USN-709-1)	Nessus	Ubuntu Local Security Checks	high
36256	Ubuntu 6.06 LTS / 7.04 / 7.10 : cpio vulnerability (USN-650-1)	Nessus	Ubuntu Local Security Checks	high
35405	FreeBSD : gtar -- GNU TAR safer_name_suffix Remote Denial of Service Vulnerability (0809ce7d-f672-4924-9b3b-7c74bc279b83)	Nessus	FreeBSD Local Security Checks	high
32140	Debian DSA-1566-1 : cpio - programming error	Nessus	Debian Local Security Checks	high
29805	Debian DSA-1438-1 : tar - several vulnerabilities	Nessus	Debian Local Security Checks	high
29406	SuSE 10 Security Update : cpio (ZYPP Patch Number 4184)	Nessus	SuSE Local Security Checks	high
28352	Mandrake Linux Security Advisory : cpio (MDKSA-2007:233)	Nessus	Mandriva Local Security Checks	high
28218	GLSA-200711-18 : Cpio: Buffer overflow	Nessus	Gentoo Local Security Checks	high
27809	Fedora 8 : cpio-2.9-5.fc8 (2007-2827)	Nessus	Fedora Local Security Checks	high
27806	Fedora 8 : tar-1.17-4.fc8 (2007-2800)	Nessus	Fedora Local Security Checks	high
27801	Fedora 7 : cpio-2.6-28.fc7 (2007-2744)	Nessus	Fedora Local Security Checks	high
27789	Fedora 7 : tar-1.15.1-28.fc7 (2007-2673)	Nessus	Fedora Local Security Checks	high
27635	Fedora Core 6 : tar-1.15.1-27.fc6 (2007-735)	Nessus	Fedora Local Security Checks	high
27188	openSUSE 10 Security Update : cpio (cpio-4180)	Nessus	SuSE Local Security Checks	high
27070	Mandrake Linux Security Advisory : tar (MDKSA-2007:197)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2007-4476

critical

Tenable Plugins

high

high

high

high

critical

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high