PT-2017-7492 · Gnu+2 · Tar+2

Publicado 2016-02-10 · Atualizado 2021-03-15 · CVE-2015-8860

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions tar versions prior to 2.0.0

Description The issue allows remote attackers to write to arbitrary files via a symlink attack in an archive. This occurs because tar does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.

Recommendations Update to version 2.0.0 or later

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

ALT-PU-2016-1086

CVE-2015-8860

GHSA-GFJR-3JMM-4G9V

USN-4777-1

Produtos afetados

Alt Linux

Ubuntu

Tar

Referências · 69

• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/openssl_ccs.rb · Nota
• https://github.com/rapid7/metasploit-framework/pull/2548 · Nota
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/nodejs_pipelining.rb · Nota
• https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356 · Nota
• https://github.com/npm/npm · Nota
• https://github.com/npm/npm/releases/tag/v2.7.5 · Nota
• https://github.com/Tripwire/OpenSSL-CCS-Inject-Test · Nota
• https://bdu.fstec.ru/vul/2015-05849 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7453 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-gfjr-3jmm-4g9v · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7452 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2015-8860 · Aviso do Fabricante