PT-2002-1082 · Gnu · Gnu Tar

Published 2002-05-20 · Updated 2024-06-15 · CVE-2002-0399

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GNU tar versions 1.13.19 through 1.13.25

Description The issue concerns a directory traversal vulnerability that can be exploited to overwrite arbitrary files during archive extraction. This can be achieved via a "/.." or "./.." string, which removes the leading slash but leaves the "..". The vulnerability can be exploited remotely, potentially leading to a breach of protected information integrity.

Recommendations For GNU tar versions 1.13.19 through 1.13.25, consider restricting access to the archive extraction functionality until a patch is available. As a temporary workaround, avoid using the vulnerable versions for extracting archives from untrusted sources.

Fix

Related Identifiers

BDU:2015-08351

CVE-2002-0399

OPENSUSE-SU-2024:11422-1

Affected Products

Gnu Tar

References · 29

• http://linuxsecurity.com/advisories/other_advisory-2400.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000928.1-1 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_05_sr.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11422-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08351 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2002:066 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-47800-1 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000538 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_19_sr.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0399 · Security Note
• http://redhat.com/support/errata/RHSA-2002-096.html · Vendor Advisory
• http://iss.net/security_center/static/10224.php · Vendor Advisory
• http://secunia.com/advisories/26673 · Note
• https://suse.com/security/cve/CVE-2006-0300 · Note
• http://securityfocus.com/bid/5834 · Note