A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences (/../) to modify arbitrary files on the system.

A flaw was found in the ArchiveTar package. PEAR ArchiveTar could allow a local authenticated attacker to bypass security restrictions caused by a stream-wrapper attack. An attacker can overwrite arbitrary files on the system using a specially-crafted tar archive.

The Archive::Tar module provides a mechanism for Perl scripts to manipulatetar archive files.Multiple directory traversal flaws were discovered in the Archive::Tarmodule. A specially-crafted tar file could cause a Perl script, using theArchive::Tar module to extract the archive, to overwrite an arbitrary filewritable by the user running the script. (CVE-2007-4829)This package upgrades the Archive::Tar module to version 1.3901. Refer tothe Archive::Tar module's changes file, linked to in the References, for afull list of changes.Users of perl-Archive-Tar are advised to upgrade to this updated package,which corrects these issues. All applications using the Archive::Tar modulemust be restarted for this update to take effect.

Directory traversal vulnerability in Archive::Tar perl module allows user-assisted remote attackers to overwrite arbitrary files writable by user running application using this module via an absolute path or a .. (dot dot) sequence in filenames in a TAR archive.

Similar issues were reported and fixed for GNU tar during past several years, e.g.: CVE-2001-1267, CVE-2002-0399, CVE-2002-1216 and CVE-2007-4131.

This issue is important when this module is used to extract tar archives from untrusted sources. However, some of such applications either implement workarounds / own checks (sa-update in spamassassin) or dropped module support at all (amavisd-new).