The version of libtar installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2013-4420 advisory.

  - Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions     in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a     crafted tar file. (CVE-2013-4420)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tar_extract_glob and tar_extract_all prefix parameter.

According to the version of the libtar package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Multiple directory traversal vulnerabilities in the (1)     tar_extract_glob and (2) tar_extract_all functions in     libtar 1.2.20 and earlier allow remote attackers to     overwrite arbitrary files via a .. (dot dot) in a     crafted tar file.(CVE-2013-4420)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libtar: missing validation of file names (CVE-2013-4420)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

An update of the libtar package has been released.

A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tar_extract_glob and tar_extract_all prefix parameter (CVE-2013-4420).

The updated packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libtar: missing validation of file names (CVE-2013-4420)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the libtar package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Multiple directory traversal vulnerabilities in the (1)     tar_extract_glob and (2) tar_extract_all functions in     libtar 1.2.20 and earlier allow remote attackers to     overwrite arbitrary files via a .. (dot dot) in a     crafted tar file.(CVE-2013-4420)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Multiple directory traversal vulnerabilities in the (1)     tar_extract_glob and (2) tar_extract_all functions in     libtar 1.2.20 and earlier allow remote attackers to     overwrite arbitrary files via a .. (dot dot) in a     crafted tar file.(CVE-2013-4420)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
201624	CBL Mariner 2.0 Security Update: libtar (CVE-2013-4420)	Nessus	MarinerOS Local Security Checks	7/3/2024	7/3/2024	high
72562	Debian DSA-2863-1 : libtar - directory traversal	Nessus	Debian Local Security Checks	2/19/2014	1/11/2021	medium
131598	EulerOS 2.0 SP2 : libtar (EulerOS-SA-2019-2444)	Nessus	Huawei Local Security Checks	12/4/2019	4/8/2024	medium
199354	RHEL 6 : libtar (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
132154	EulerOS 2.0 SP3 : libtar (EulerOS-SA-2019-2619)	Nessus	Huawei Local Security Checks	12/18/2019	4/3/2024	medium
121929	Photon OS 2.0: Libtar PHSA-2018-2.0-0029	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	high
72614	Mandriva Linux Security Advisory : libtar (MDVSA-2014:045)	Nessus	Mandriva Local Security Checks	2/21/2014	1/6/2021	medium
199322	RHEL 7 : libtar (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
151335	EulerOS Virtualization for ARM 64 3.0.2.0 : libtar (EulerOS-SA-2021-2106)	Nessus	Huawei Local Security Checks	7/2/2021	12/26/2023	high
152322	EulerOS 2.0 SP8 : libtar (EulerOS-SA-2021-2302)	Nessus	Huawei Local Security Checks	8/9/2021	12/26/2023	high
146112	EulerOS 2.0 SP5 : libtar (EulerOS-SA-2021-1206)	Nessus	Huawei Local Security Checks	2/4/2021	1/24/2024	medium
147118	EulerOS Virtualization 3.0.6.6 : libtar (EulerOS-SA-2021-1491)	Nessus	Huawei Local Security Checks	3/4/2021	1/12/2024	high
121744	Photon OS 1.0: Libtar PHSA-2017-0040	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	high

Detections

Analytics

Plugins Search

high

medium

medium

high

medium

high

medium

high

high

high

medium

high

high