The version of libtar installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2013-4420 advisory.

  - Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions     in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a     crafted tar file. (CVE-2013-4420)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libtar package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Multiple directory traversal vulnerabilities in the (1)     tar_extract_glob and (2) tar_extract_all functions in     libtar 1.2.20 and earlier allow remote attackers to     overwrite arbitrary files via a .. (dot dot) in a     crafted tar file.(CVE-2013-4420)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions     in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a     crafted tar file. (CVE-2013-4420)

Note that Nessus relies on the presence of the package as reported by the vendor.

A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tar_extract_glob and tar_extract_all prefix parameter.

An update of [openjdk,openjre,bash,libtar,glibc,libgcrypt,strongswan,unzip] packages for PhotonOS has been released.

According to the version of the libtar package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Multiple directory traversal vulnerabilities in the (1)     tar_extract_glob and (2) tar_extract_all functions in     libtar 1.2.20 and earlier allow remote attackers to     overwrite arbitrary files via a .. (dot dot) in a     crafted tar file.(CVE-2013-4420)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Multiple directory traversal vulnerabilities in the (1)     tar_extract_glob and (2) tar_extract_all functions in     libtar 1.2.20 and earlier allow remote attackers to     overwrite arbitrary files via a .. (dot dot) in a     crafted tar file.(CVE-2013-4420)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libtar package has been released.

A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tar_extract_glob and tar_extract_all prefix parameter (CVE-2013-4420).

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Published	Updated	Severity
201624	CBL Mariner 2.0 Security Update: libtar (CVE-2013-4420)	Nessus	MarinerOS Local Security Checks	7/3/2024	7/3/2024	high
131598	EulerOS 2.0 SP2 : libtar (EulerOS-SA-2019-2444)	Nessus	Huawei Local Security Checks	12/4/2019	4/8/2024	medium
217883	Linux Distros Unpatched Vulnerability : CVE-2013-4420	Nessus	Misc.	3/4/2025	3/4/2025	high
72562	Debian DSA-2863-1 : libtar - directory traversal	Nessus	Debian Local Security Checks	2/19/2014	1/11/2021	medium
111889	Photon OS 1.0: Bash / Glibc / Libgcrypt / Libtar / Openjdk / Openjre / Strongswan / Unzip PHSA-2017-0040 (deprecated)	Nessus	PhotonOS Local Security Checks	8/17/2018	4/5/2019	critical
151335	EulerOS Virtualization for ARM 64 3.0.2.0 : libtar (EulerOS-SA-2021-2106)	Nessus	Huawei Local Security Checks	7/2/2021	12/26/2023	high
146112	EulerOS 2.0 SP5 : libtar (EulerOS-SA-2021-1206)	Nessus	Huawei Local Security Checks	2/4/2021	1/24/2024	medium
147118	EulerOS Virtualization 3.0.6.6 : libtar (EulerOS-SA-2021-1491)	Nessus	Huawei Local Security Checks	3/4/2021	1/12/2024	high
121744	Photon OS 1.0: Libtar PHSA-2017-0040	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	high
152322	EulerOS 2.0 SP8 : libtar (EulerOS-SA-2021-2302)	Nessus	Huawei Local Security Checks	8/9/2021	12/26/2023	high
72614	Mandriva Linux Security Advisory : libtar (MDVSA-2014:045)	Nessus	Mandriva Local Security Checks	2/21/2014	1/6/2021	medium
121929	Photon OS 2.0: Libtar PHSA-2018-2.0-0029	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	high
132154	EulerOS 2.0 SP3 : libtar (EulerOS-SA-2019-2619)	Nessus	Huawei Local Security Checks	12/18/2019	4/3/2024	medium
233766	Photon OS 5.0: Libtar PHSA-2024-5.0-0424	Nessus	PhotonOS Local Security Checks	4/2/2025	4/2/2025	high

Detections

Analytics

Plugins Search

high

medium

high

medium

critical

high

medium

high

high

high

medium

high

medium

high