Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the filename parameter, aka POINTYFEATHER.

A Heap Buffer Overflow issue takes place at fromheader() in list.c in the tar application. The issue occurs when attempting to read files with old V7 tar format with an especially crafted checksum. As a result, an invalid memory read that leads to a conditional jump or move operation on uninitialised memory values takes place.

Reference:

https://savannah.gnu.org/bugs/?62387

Directory traversal vulnerability was discovered in GNU tar. Vulnerability can be exploited by specially crafted tar archive to overwrite arbitrary file writable by user running tar. Problem occurs in containsdotdot function, which does not properly check names of directory symlinks.

Acknowledgements:

Red Hat would like to thank Dmitry V. Levin for reporting this issue.

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4476 to the following vulnerability:

Bug in the safernamesuffix function in GNU tar may lead to a "crashing stack". It can be used to crash tar while extracting archive containing file with long name containing unsafe prefix.

Affected function is also part of cpio source code.

References:

http://www.novell.com/linux/security/advisories/200718sr.html http://lists.gnu.org/archive/html/bug-cpio/2007-08/msg00002.html