CVE-2002-0399: Medium severity GNU tar vulnerability
Directory traversal vulnerability in GNU tar 1.13.19 through 1.13.25, and possibly later versions, allows attackers to overwrite arbitrary files during archive extraction via a (1) "/.." or (2) "./.." string, which removes the leading slash but leaves the "..", a variant of CVE-2001-1267.
Other sources
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2002-0399?
CVE-2002-0399 has a high severity rating due to its potential to allow unauthorized file overwriting.
How do I fix CVE-2002-0399?
To fix CVE-2002-0399, upgrade to GNU tar version 1.13.26 or later, which addresses the directory traversal vulnerability.
What software is affected by CVE-2002-0399?
CVE-2002-0399 affects GNU tar versions 1.13.19 through 1.13.25.
Can CVE-2002-0399 lead to remote code execution?
CVE-2002-0399 can potentially lead to remote code execution if an attacker can exploit the file overwriting capability.
What is directory traversal in the context of CVE-2002-0399?
Directory traversal in CVE-2002-0399 refers to the ability to navigate and overwrite files outside the intended directory using specific path traversal sequences.