PT-2007-1009 · Gnu+2 · Gnu Tar+2

Published 2007-08-23 · Updated 2018-10-15 · CVE-2007-4131

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Debian GNU/Linux (affected versions not specified) GNU tar (affected versions not specified)

Description: The issue concerns multiple vulnerabilities in the tar package of Debian GNU/Linux, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. A directory traversal vulnerability in the contains dot dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

Recommendations: For Debian GNU/Linux, update the tar package to a version that includes the fix for the directory traversal vulnerability. For GNU tar, avoid using the contains dot dot function until a patch is available, and restrict access to the src/names.c module to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-01807

CVE-2007-4131

DSA-1438-1

RHSA-2007:0860

RHSA-2007_0860

Affected Products

Debian

Gnu Tar

Red Hat

References · 47

• http://novell.com/linux/security/advisories/2007_18_sr.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4131 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-4131 · Vendor Advisory
• http://trustix.org/errata/2007/0026 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-4131 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:173 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021680.1-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · Vendor Advisory
• http://security.freebsd.org/advisories/FreeBSD-SA-07:10.gtar.asc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-4131 · Vendor Advisory
• http://ubuntu.com/usn/usn-506-1 · Vendor Advisory
• http://debian.org/security/2007/dsa-1438 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0159 · Security Note
• https://bdu.fstec.ru/vul/2015-01807 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-October/msg00370.html · Vendor Advisory