CVE-2013-4420: Path Traversal
Published Dec 10, 2013
·Updated
Multiple directory traversal vulnerabilities in the (1) tarextractglob and (2) tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.
Affected Software
10 affected componentsFixes available
debian/libtar
1.2.20-81.2.20-8.1
Feep Libtar<=1.2.20
Feep Libtar=1.2.11
Feep Libtar=1.2.13
Feep Libtar=1.2.14
Feep Libtar=1.2.15
Feep Libtar=1.2.16
Feep Libtar=1.2.17
Feep Libtar=1.2.18
Feep Libtar=1.2.19
Event History
Dec 10, 2013
Data Sourced
03:30 PM
SeverityAffected Software
Feb 20, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4420?
CVE-2013-4420 is classified as a high severity vulnerability due to its ability to allow remote attackers to overwrite arbitrary files.
2
How do I fix CVE-2013-4420?
To fix CVE-2013-4420, upgrade the libtar package to version 1.2.20-9 or later.
3
Which versions of libtar are affected by CVE-2013-4420?
CVE-2013-4420 affects libtar versions up to and including 1.2.20.
4
What are the consequences of exploiting CVE-2013-4420?
Exploiting CVE-2013-4420 can lead to unauthorized file access and overwriting of critical system files.
5
Is CVE-2013-4420 a remote vulnerability?
Yes, CVE-2013-4420 is a remote vulnerability that can be exploited by attackers through crafted tar files.