CVE-2005-1918
published 2005-12-31CVE-2005-1918: The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that…
PriorityP417low2.6CVSS 2.0
AVNACHAuNCNIPAN
EPSS
2.86%
85.2th percentile
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tar | < tar 1.14-2.2 (bookworm) | tar 1.14-2.2 (bookworm) |
| gnu | tar | — | — |
| gnu | tar | >= 0 < 1.14-2.2 | 1.14-2.2 |
| gnu | tar | >= 0 < 1.14-2.2 | 1.14-2.2 |
| gnu | tar | >= 0 < 1.14-2.2 | 1.14-2.2 |
| gnu | tar | >= 0 < 1.14-2.2 | 1.14-2.2 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | linux_advanced_workstation | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vf44-2j68-pjgj: The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2
ghsa_unreviewed·2022-05-03·CVSS 5.0
CVE-2005-1918 [MEDIUM] CWE-22 GHSA-vf44-2j68-pjgj: The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
OSV
CVE-2005-1918: The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2
osv·2005-12-31·CVSS 5.0
CVE-2005-1918 [MEDIUM] CVE-2005-1918: The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
Debian
CVE-2005-1918: tar - The original patch for a GNU tar directory traversal vulnerability (CVE-2002-039...
vendor_debian·2005·CVSS 5.0
CVE-2005-1918 [MEDIUM] CVE-2005-1918: tar - The original patch for a GNU tar directory traversal vulnerability (CVE-2002-039...
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
Scope: local
bookworm: resolved (fixed in 1.14-2.2)
bullseye: resolved (fixed in 1.14-2.2)
forky: resolved (fixed in 1.14-2.2)
sid: resolved (fixed in 1.14-2.2)
trixie: resolved (fixed in 1.14-2.2)
Red Hat
tar archive path traversal issue
vendor_redhat·2003-07-21·CVSS 5.0
CVE-2005-1918 [MEDIUM] tar archive path traversal issue
tar archive path traversal issue
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
No detection rules found.
No public exploits indexed.
Bugzilla
Multiple tar issues (CVE-2005-1918, CVE-2006-0300)
bugzilla·2006-03-02·CVSS 5.0
CVE-2005-1918 [MEDIUM] Multiple tar issues (CVE-2005-1918, CVE-2006-0300)
Multiple tar issues (CVE-2005-1918, CVE-2006-0300)
There are two separate issues that affect different subsets of our products.
I. RHL 7.3, RHL 9, FC1 & FC2: tar archive path traversal issue
CVE-2005-1918: "The original patch for a GNU tar directory traversal
vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses
an 'incorrect optimization' that allows user-complicit attackers to over-
write arbitrary files via a crafted tar file, probably involving '/../'
sequences with a leading '/'."
This vulnerability appears to only affect tar-1.13.25 releases, which
these four distros use.
Red Hat issued RHSA-2006:0195-01 for RHEL 2.1 and RHEL 3:
"In 2002, a path traversal flaw was found in the way GNU tar extracted
archives. A malicious user could create a tar archive that cou
Bugzilla
CVE-2005-1918 tar archive path traversal issue
bugzilla·2004-11-23·CVSS 2.6
CVE-2005-1918 [LOW] CVE-2005-1918 tar archive path traversal issue
CVE-2005-1918 tar archive path traversal issue
There is an old path traversal issue that we've not fixed.
The text of the message describing this:
The tar patch "tar-1.13.25-dots.patch" changes....
for (;;)
{
if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
return 1;
do
{
if (! *p++)
return 0;
}
while (! ISSLASH (*p));
}
...into...
for (;;)
{
if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
return 1;
do
{
if (! *p++)
return 0;
}
while (! ISSLASH (*p));
do
{
if (! *p++)
return 0;
}
while ( ISSLASH (*p));
}
...which looks like it's an optimization, however it also changes the
answer for "/../etc/passwd" ... changing both do while's to just plain
while's should fix it.
This issue also affects RHEL 2.1
Discussion:
Created attachment 111155
I hope this patc
Bugzilla
CVE-2005-1918 tar archive path traversal issue
bugzilla·2004-11-23·CVSS 2.6
CVE-2005-1918 [LOW] CVE-2005-1918 tar archive path traversal issue
CVE-2005-1918 tar archive path traversal issue
Placeholder for RHEL2.1 issue.
See bug 140589 for more information.
Discussion:
Lifting embargo
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2006-0195.html
ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.aschttp://secunia.com/advisories/18988http://secunia.com/advisories/19130http://secunia.com/advisories/19183http://secunia.com/advisories/20397http://securitytracker.com/id?1015655http://support.avaya.com/elmodocs2/security/ASA-2006-110.htmhttp://www.novell.com/linux/security/advisories/2006_05_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0195.htmlhttp://www.securityfocus.com/archive/1/430297/100/0/threadedhttp://www.securityfocus.com/bid/5834https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=140589https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9946ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.aschttp://secunia.com/advisories/18988http://secunia.com/advisories/19130http://secunia.com/advisories/19183http://secunia.com/advisories/20397http://securitytracker.com/id?1015655http://support.avaya.com/elmodocs2/security/ASA-2006-110.htmhttp://www.novell.com/linux/security/advisories/2006_05_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0195.htmlhttp://www.securityfocus.com/archive/1/430297/100/0/threadedhttp://www.securityfocus.com/bid/5834https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=140589https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9946
2005-12-31
Published