PT-2006-1974 · Pear · Pear Archive Tar

Hamid Ebadi · Published 2006-02-28 · Updated 2022-05-01 · CVE-2006-0931

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PEAR::Archive Tar versions 1.2 through 1.3.1

Description A directory traversal issue allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.

Recommendations For PEAR::Archive Tar versions 1.2 through 1.3.1, update to version 1.3.2 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2006-0931

GHSA-F3XW-VGC7-F7H8

Affected Products

Pear Archive Tar

References · 11

• http://hamid.ir/security/phptar.txt · Vendor Advisory
• http://secunia.com/advisories/19011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0931 · Security Note
• https://osv.dev/vulnerability/GHSA-f3xw-vgc7-f7h8 · Vendor Advisory
• https://github.com/pear/Archive_Tar · Note
• http://pear.php.net/package/Archive_Tar/download · Note
• http://pear.php.net/bugs/bug.php?id=6933 · Note
• http://securityfocus.com/archive/1/425967/100/0/threaded · Note
• http://osvdb.org/23481 · Note
• http://securityfocus.com/bid/16805 · Note
• http://vupen.com/english/advisories/2006/0728 · Note