PT-2002-1082 · Gnu · Gnu Tar
Publicado
2002-05-20
·
Atualizado
2024-06-15
·
CVE-2002-0399
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
GNU tar versions 1.13.19 through 1.13.25
Description
The issue concerns a directory traversal vulnerability that can be exploited to overwrite arbitrary files during archive extraction. This can be achieved via a "/.." or "./.." string, which removes the leading slash but leaves the "..". The vulnerability can be exploited remotely, potentially leading to a breach of protected information integrity.
Recommendations
For GNU tar versions 1.13.19 through 1.13.25, consider restricting access to the archive extraction functionality until a patch is available. As a temporary workaround, avoid using the vulnerable versions for extracting archives from untrusted sources.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Gnu Tar