REDHAT-BUG-295021: Medium severity pear archive_tar vulnerability
Directory traversal vulnerability in Archive::Tar perl module allows user-assisted remote attackers to overwrite arbitrary files writable by user running application using this module via an absolute path or a .. (dot dot) sequence in filenames in a TAR archive.
Similar issues were reported and fixed for GNU tar during past several years, e.g.: CVE-2001-1267, CVE-2002-0399, CVE-2002-1216 and CVE-2007-4131.
This issue is important when this module is used to extract tar archives from untrusted sources. However, some of such applications either implement workarounds / own checks (sa-update in spamassassin) or dropped module support at all (amavisd-new).
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-295021?
The severity of REDHAT-BUG-295021 is considered high due to the potential for remote attackers to overwrite arbitrary files.
How do I fix REDHAT-BUG-295021?
To fix REDHAT-BUG-295021, update the Archive::Tar module to the latest version that addresses this vulnerability.
Who is affected by REDHAT-BUG-295021?
Users running applications that utilize the Archive::Tar module in Perl are affected by REDHAT-BUG-295021.
What exploit methods are used in REDHAT-BUG-295021?
Attackers can exploit REDHAT-BUG-295021 by using absolute paths or dot dot sequences in filenames within a TAR archive.
Are there any workarounds for REDHAT-BUG-295021?
A possible workaround for REDHAT-BUG-295021 is to restrict the file permissions to prevent the application from overwriting critical files.