PT-2006-6742 · Gnu+1 · Gnu Tar+1

Kees Cook + 1 · Publicado 2006-11-24 · Atualizado 2024-06-15 · CVE-2006-6097

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU tar versions 1.15.1 through 1.16

Description The issue allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE NAMES record with a symbolic link. This is due to improper handling by the extract archive function in extract.c and the extract mangle function in mangle.c.

Recommendations For GNU tar versions 1.15.1 through 1.16, consider restricting the use of tar files that contain GNUTYPE NAMES records with symbolic links until a patch is available. As a temporary workaround, avoid using the extract archive function and extract mangle function in extract.c and mangle.c, respectively, to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-6097

DSA-1223-1

OPENSUSE-SU-2024:11422-1

RHSA-2006:0749

RHSA-2006_0749

Produtos afetados

Gnu Tar

Red Hat

Referências · 58

• 🔥 http://securityfocus.com/bid/21235 · Exploit
• 🔥 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216937 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050812.html · Exploit
• 🔥 https://exploit-db.com/exploits/29160 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6097 · Aviso do Fabricante
• http://secunia.com/advisories/23115 · Nota
• http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.469379 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/4717 · Nota
• http://trustix.org/errata/2006/0068 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200612-10.xml · Aviso do Fabricante
• http://docs.info.apple.com/article.html?artnum=305214 · Nota
• https://suse.com/security/cve/CVE-2006-6097 · Nota
• https://access.redhat.com/security/cve/CVE-2006-6097 · Nota
• http://vupen.com/english/advisories/2007/1171 · Nota