CVE-2018-20482: Medium severity ubuntu tar vulnerability
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparsedumpregion in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20482?
The severity of CVE-2018-20482 is medium with a CVSS severity score of 4.7.
How does CVE-2018-20482 affect GNU Tar?
CVE-2018-20482 affects GNU Tar versions up to and including 1.30 when the --sparse option is used.
How does CVE-2018-20482 impact Debian Debian Linux 8.0?
CVE-2018-20482 impacts Debian Debian Linux 8.0.
How can a local user exploit CVE-2018-20482?
A local user can exploit CVE-2018-20482 by modifying a file that is supposed to be archived by a different user's process, causing a denial of service with an infinite read loop in sparse_dump_region in sparse.c.
Are there any fixes available for CVE-2018-20482?
Yes, fixes are available for CVE-2018-20482. It is recommended to update GNU Tar to a version higher than 1.30.