In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - ark: crafted TAR archive with symlinks can install files outside the extraction directory (CVE-2020-24654)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3015 advisory.

  - In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the     extraction directory via ../ directory traversal. (CVE-2020-16116)

  - In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction     directory, as demonstrated by a write operation to a user's home directory. (CVE-2020-24654)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-06 (Ark: Symlink vulnerability)

    KDE Ark did not fully verify symlinks contained within tar archives.
  Impact :

    A remote attacker could entice a user to open a specially crafted tar       archive using KDE Ark, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-202010-06 (Ark: Arbitrary code execution)

    It was discovered that Ark incorrectly handled symbolic links in tar       archive files.
  Impact :

    A remote attacker could entice a user to open a specially crafted       archive using Ark, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

security fix for CVE-2020-24654

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fabian Vogt reported that the Ark archive manager did not sanitise extraction paths, which could result in maliciously crafted archives with symlinks writing outside the extraction directory.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4482-1 advisory.

    Fabian Vogt discovered that Ark incorrectly handled symbolic links in tar archive files. An attacker could     use this to construct a malicious tar archive that, when opened, would create files outside the extraction     directory.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for ark fixes the following issues :

  - CVE-2020-24654: maliciously crafted TAR archive can     install files outside the extraction directory     (boo#1175857)&#9;

Albert Astals Cid reports : Overview A maliciously crafted TAR archive containing symlink entries would install files anywhere in the user's home directory upon extraction. Proof of concept For testing, an example of malicious archive can be found at dirsymlink.tar Impact Users can unwillingly install files like a modified .bashrc, or a malicious script placed in ~/.config/autostart. Workaround Before extracting a downloaded archive using the Ark GUI, users should inspect it to make sure it doesn't contain symlink entries pointing outside the extraction folder.

The 'Extract' context menu from the Dolphin file manager shouldn't be used. Solution Ark 20.08.1 skips maliciously crafted symlinks when extracting TAR archives.

Alternatively, 8bf8c5ef07b0ac5e914d752681e470dea403a5bd can be applied to previous releases. Credits Thanks to Fabian Vogt for reporting this issue and for fixing it.

ID	Name	Product	Family	Severity
199884	RHEL 7 : ark (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
161432	Debian DLA-3015-1 : ark - LTS security update	Nessus	Debian Local Security Checks	low
144865	GLSA-202101-06 : Ark: Symlink vulnerability	Nessus	Gentoo Local Security Checks	low
141732	GLSA-202010-06 : Ark: Arbitrary code execution	Nessus	Gentoo Local Security Checks	low
140309	Fedora 32 : ark (2020-c2f8a1e8a5)	Nessus	Fedora Local Security Checks	low
140300	Debian DSA-4759-1 : ark - security update	Nessus	Debian Local Security Checks	low
140180	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Ark vulnerability (USN-4482-1)	Nessus	Ubuntu Local Security Checks	low
140172	openSUSE Security Update : ark (openSUSE-2020-1310)	Nessus	SuSE Local Security Checks	low
139934	FreeBSD : ark -- extraction outside of extraction directory (38fdf07b-e8ec-11ea-8bbe-e0d55e2a8bf9)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2020-24654

low

Tenable Plugins

low

low

low

low

low

low

low

low

low