A Heap Buffer Overflow issue takes place at fromheader() in list.c in the tar application. The issue occurs when attempting to read files with old V7 tar format with an especially crafted checksum. As a result, an invalid memory read that leads to a conditional jump or move operation on uninitialised memory values takes place.
Reference:
https://savannah.gnu.org/bugs/?62387
An issue was discovered in GNU Tar 1.33 and earlier. There is a memory leak in readheader() in list.c in the tar application.
Upstream bug:
https://savannah.gnu.org/bugs/?59897
Upstream patch:
https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparsedumpregion in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the filename parameter, aka POINTYFEATHER.
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4476 to the following vulnerability:
Bug in the safernamesuffix function in GNU tar may lead to a "crashing stack". It can be used to crash tar while extracting archive containing file with long name containing unsafe prefix.
Affected function is also part of cpio source code.
References:
http://www.novell.com/linux/security/advisories/200718sr.html http://lists.gnu.org/archive/html/bug-cpio/2007-08/msg00002.html
Directory traversal vulnerability was discovered in GNU tar. Vulnerability can be exploited by specially crafted tar archive to overwrite arbitrary file writable by user running tar. Problem occurs in containsdotdot function, which does not properly check names of directory symlinks.
Acknowledgements:
Red Hat would like to thank Dmitry V. Levin for reporting this issue.