Directory traversal vulnerability was discovered in GNU tar. Vulnerability can be exploited by specially crafted tar archive to overwrite arbitrary file writable by user running tar. Problem occurs in containsdotdot function, which does not properly check names of directory symlinks.

Acknowledgements:

Red Hat would like to thank Dmitry V. Levin for reporting this issue.

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4476 to the following vulnerability:

Bug in the safernamesuffix function in GNU tar may lead to a "crashing stack". It can be used to crash tar while extracting archive containing file with long name containing unsafe prefix.

Affected function is also part of cpio source code.

References:

http://www.novell.com/linux/security/advisories/200718sr.html http://lists.gnu.org/archive/html/bug-cpio/2007-08/msg00002.html