tar security update

2007-08-2316:49:59

CentOS Project

lists.centos.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.02 Low

EPSS

Percentile

88.9%

JSON

CentOS Errata and Security Advisory CESA-2007:0860

The GNU tar program saves many files together in one archive and can
restore individual files (or all of the files) from that archive.

A path traversal flaw was discovered in the way GNU tar extracted archives.
A malicious user could create a tar archive that could write to arbitrary
files to which the user running GNU tar had write access. (CVE-2007-4131)

Red Hat would like to thank Dmitry V. Levin for reporting this issue.

Users of tar should upgrade to this updated package, which contains a
replacement backported patch to correct this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-August/076311.html
https://lists.centos.org/pipermail/centos-announce/2007-August/076312.html
https://lists.centos.org/pipermail/centos-announce/2007-August/076313.html
https://lists.centos.org/pipermail/centos-announce/2007-August/076314.html
https://lists.centos.org/pipermail/centos-announce/2007-August/076315.html
https://lists.centos.org/pipermail/centos-announce/2007-August/076316.html

Affected packages:
tar

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0860

OSVersionArchitecturePackageVersionFilename
CentOS4ia64tar< 1.14-12.5.1.RHEL4tar-1.14-12.5.1.RHEL4.ia64.rpm
CentOS4s390tar< 1.14-12.5.1.RHEL4tar-1.14-12.5.1.RHEL4.s390.rpm
CentOS4s390xtar< 1.14-12.5.1.RHEL4tar-1.14-12.5.1.RHEL4.s390x.rpm
CentOS5i386tar< 1.15.1-23.0.1.el5tar-1.15.1-23.0.1.el5.i386.rpm
CentOS5x86_64tar< 1.15.1-23.0.1.el5tar-1.15.1-23.0.1.el5.x86_64.rpm
CentOS4i386tar< 1.14-12.5.1.RHEL4tar-1.14-12.5.1.RHEL4.i386.rpm
CentOS4x86_64tar< 1.14-12.5.1.RHEL4tar-1.14-12.5.1.RHEL4.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	4	ia64	tar	< 1.14-12.5.1.RHEL4	tar-1.14-12.5.1.RHEL4.ia64.rpm
CentOS	4	s390	tar	< 1.14-12.5.1.RHEL4	tar-1.14-12.5.1.RHEL4.s390.rpm
CentOS	4	s390x	tar	< 1.14-12.5.1.RHEL4	tar-1.14-12.5.1.RHEL4.s390x.rpm
CentOS	5	i386	tar	< 1.15.1-23.0.1.el5	tar-1.15.1-23.0.1.el5.i386.rpm
CentOS	5	x86_64	tar	< 1.15.1-23.0.1.el5	tar-1.15.1-23.0.1.el5.x86_64.rpm
CentOS	4	i386	tar	< 1.14-12.5.1.RHEL4	tar-1.14-12.5.1.RHEL4.i386.rpm
CentOS	4	x86_64	tar	< 1.14-12.5.1.RHEL4	tar-1.14-12.5.1.RHEL4.x86_64.rpm