PT-2006-6742 · Gnu+1 · Gnu Tar+1

Kees Cook + 1 · Published 2006-11-24 · Updated 2024-06-15 · CVE-2006-6097

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU tar versions 1.15.1 through 1.16

Description The issue allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE NAMES record with a symbolic link. This is due to improper handling by the extract archive function in extract.c and the extract mangle function in mangle.c.

Recommendations For GNU tar versions 1.15.1 through 1.16, consider restricting the use of tar files that contain GNUTYPE NAMES records with symbolic links until a patch is available. As a temporary workaround, avoid using the extract archive function and extract mangle function in extract.c and mangle.c, respectively, to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-6097

DSA-1223-1

OPENSUSE-SU-2024:11422-1

RHSA-2006:0749

RHSA-2006_0749

Affected Products

Gnu Tar

Red Hat

References · 58

• 🔥 http://securityfocus.com/bid/21235 · Exploit
• 🔥 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216937 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050812.html · Exploit
• 🔥 https://exploit-db.com/exploits/29160 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6097 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.469379 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html · Vendor Advisory
• http://trustix.org/errata/2006/0068 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200612-10.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-385-1 · Vendor Advisory
• http://openpkg.com/security/advisories/OpenPKG-SA-2006.038.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2006-0749.html · Vendor Advisory
• http://security.freebsd.org/advisories/FreeBSD-SA-06:26.gtar.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6097 · Security Note
• https://osv.dev/vulnerability/CVE-2006-6097 · Vendor Advisory