In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3015 advisory.

  - In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the     extraction directory via ../ directory traversal. (CVE-2020-16116)

  - In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction     directory, as demonstrated by a write operation to a user's home directory. (CVE-2020-24654)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4461-1 advisory.

    Dominik Penner discovered that Ark did not properly sanitize zip archive files before performing     extraction. An attacker could use this to construct a malicious zip archive that, when opened, would     create files outside the extraction directory.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for ark fixes the following issues :

  - Fixed a directory traversal bug (boo#1174773,     CVE-2020-16116).

Security update for CVE-2020-16116, https://kde.org/info/security/advisory-20200730-1.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202008-03 (Ark: Arbitrary code execution)

    A maliciously crafted archive with &ldquo;../&rdquo; in the file path(s) could       install files anywhere in the user&rsquo;s home directory upon extraction.
  Impact :

    A remote attacker could entice a user to open a specially crafted       archive using Ark, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    Avoid opening untrusted archives.

Dominik Penner discovered that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives writing outside the extraction directory.

KDE Project Security Advisory reports : KDE Project Security AdvisoryTitle:Ark: maliciously crafted archive can install files outside the extraction directory.Risk Rating:ImportantCVE:CVE-2020-16116Versions:ark <= 20.04.3Author:Elvis Angelaccio <elvis.angelaccio@kde.org>Date:30 July 2020Overview A maliciously crafted archive with '../' in the file paths would install files anywhere in the user's home directory upon extraction. Proof of concept For testing, an example of malicious archive can be found at https://github.com/jwilk/traversal-archives/releases/download/0/relati ve2.zip Impact Users can unwillingly install files like a modified .bashrc, or a malicious script placed in ~/.config/autostart Workaround Users should not use the 'Extract' context menu from the Dolphin file manager. Before extracting a downloaded archive using the Ark GUI, users should inspect it to make sure it doesn't contain entries with '../' in the file path. Solution Ark 20.08.0 prevents loading of malicious archives and shows a warning message to the users.

Alternatively, https://invent.kde.org/utilities/ark/-/commit/0df592524fed305d6fbe74dd f8a196bc9ffdb92f can be applied to previous releases. Credits Thanks to Dominik Penner for finding and reporting this issue and thanks to Elvis Angelaccio and Albert Astals Cid for fixing it.

ID	Name	Product	Family	Severity
161432	Debian DLA-3015-1 : ark - LTS security update	Nessus	Debian Local Security Checks	low
139660	Ubuntu 18.04 LTS / 20.04 LTS : Ark vulnerability (USN-4461-1)	Nessus	Ubuntu Local Security Checks	low
139560	openSUSE Security Update : ark (openSUSE-2020-1183)	Nessus	SuSE Local Security Checks	low
139556	Fedora 32 : ark (2020-e2fe8f0165)	Nessus	Fedora Local Security Checks	low
139438	GLSA-202008-03 : Ark: Arbitrary code execution	Nessus	Gentoo Local Security Checks	low
139434	Fedora 31 : ark (2020-cac5ae9b6e)	Nessus	Fedora Local Security Checks	low
139254	Debian DSA-4738-1 : ark - security update	Nessus	Debian Local Security Checks	low
139218	FreeBSD : ark -- directory traversal (d1ef1138-d273-11ea-a757-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2020-16116

low

Tenable Plugins

low

low

low

low

low

low

low

low