CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:P/A:P
AI Score
Confidence
High
EPSS
Percentile
71.6%
Debian Security Advisory DSA-2863-1 [email protected]
http://www.debian.org/security/ Luciano Bello
February 18, 2014 http://www.debian.org/security/faq
Package : libtar
Vulnerability : directory traversal
CVE ID : CVE-2013-4420
Debian Bug : 731860
A directory traversal attack was reported against libtar, a C library for
manipulating tar archives. The application does not validate the
filenames inside the tar archive, allowing to extract files in arbitrary
path. An attacker can craft a tar file to override files beyond the
tar_extract_glob and tar_extract_all prefix parameter.
For the oldstable distribution (squeeze), this problem has been fixed in
version 1.2.11-6+deb6u2.
For the stable distribution (wheezy), this problem has been fixed in
version 1.2.16-1+deb7u2.
For the unstable distribution (sid), this problem has been fixed in
version 1.2.20-2.
We recommend that you upgrade your libtar packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | mipsel | libtar0 | < 1.2.16-1+deb7u2 | libtar0_1.2.16-1+deb7u2_mipsel.deb |
Debian | 7 | kfreebsd-amd64 | libtar0 | < 1.2.16-1+deb7u2 | libtar0_1.2.16-1+deb7u2_kfreebsd-amd64.deb |
Debian | 7 | amd64 | libtar-dev | < 1.2.16-1+deb7u2 | libtar-dev_1.2.16-1+deb7u2_amd64.deb |
Debian | 7 | powerpc | libtar0 | < 1.2.16-1+deb7u2 | libtar0_1.2.16-1+deb7u2_powerpc.deb |
Debian | 6 | mipsel | libtar | < 1.2.11-6+deb6u2 | libtar_1.2.11-6+deb6u2_mipsel.deb |
Debian | 6 | i386 | libtar-dev | < 1.2.11-6+deb6u2 | libtar-dev_1.2.11-6+deb6u2_i386.deb |
Debian | 7 | ia64 | libtar-dev | < 1.2.16-1+deb7u2 | libtar-dev_1.2.16-1+deb7u2_ia64.deb |
Debian | 6 | kfreebsd-amd64 | libtar | < 1.2.11-6+deb6u2 | libtar_1.2.11-6+deb6u2_kfreebsd-amd64.deb |
Debian | 6 | ia64 | libtar-dev | < 1.2.11-6+deb6u2 | libtar-dev_1.2.11-6+deb6u2_ia64.deb |
Debian | 6 | mips | libtar | < 1.2.11-6+deb6u2 | libtar_1.2.11-6+deb6u2_mips.deb |