CVE-2007-4131
published 2007-08-25CVE-2007-4131: Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files…
PriorityP429medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.74%
84.5th percentile
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tar | < tar 1.18-2 (bookworm) | tar 1.18-2 (bookworm) |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | — | — |
| gnu | tar | >= 0 < 1.18-2 | 1.18-2 |
| gnu | tar | >= 0 < 1.18-2 | 1.18-2 |
| gnu | tar | >= 0 < 1.18-2 | 1.18-2 |
| gnu | tar | >= 0 < 1.18-2 | 1.18-2 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-43w6-q9mv-9cwf: Directory traversal vulnerability in the contains_dot_dot function in src/names
ghsa_unreviewed·2022-05-01
CVE-2007-4131 [MEDIUM] GHSA-43w6-q9mv-9cwf: Directory traversal vulnerability in the contains_dot_dot function in src/names
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
OSV
CVE-2007-4131: Directory traversal vulnerability in the contains_dot_dot function in src/names
osv·2007-08-25·CVSS 6.8
CVE-2007-4131 [MEDIUM] CVE-2007-4131: Directory traversal vulnerability in the contains_dot_dot function in src/names
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
BSD
FreeBSD-SA-07:10.gtar: gtar directory traversal vulnerability
bsd_advisories·2007-11-29·CVSS 6.8
CVE-2007-4131 [MEDIUM] FreeBSD-SA-07:10.gtar: gtar directory traversal vulnerability
FreeBSD-SA-07:10.gtar Security Advisory
The FreeBSD Project
Topic: gtar directory traversal vulnerability
Category: contrib
Module: contrib_tar
Announced: 2007-11-29
Credits: Dmitry V. Levinx
Affects: FreeBSD 5.x releases
Corrected: 2007-11-29 16:08:54 UTC (RELENG_5, 5.5-STABLE)
2007-11-29 16:09:26 UTC (RELENG_5_5, 5.5-RELEASE-p17)
CVE Name: CVE-2007-4131
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
GNU tar (gtar) is a utility to create and extract "tape archives",
commonly known as tar files. GNU tar is included in FreeBSD 5.x as
/usr/bin/gtar.
II. Problem Description
Insufficient sanity checking of paths containing '.' and '..' allows
gtar to ov
Ubuntu
tar vulnerability
vendor_ubuntu·2007-08-28
CVE-2007-4131 tar vulnerability
Title: tar vulnerability
Summary: tar vulnerability
Dmitry V. Levin discovered that tar did not correctly detect the ".."
file path element when unpacking archives. If a user or an automated
system were tricked into unpacking a specially crafted tar file, arbitrary
files could be overwritten with user privileges.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
tar directory traversal vulnerability
vendor_redhat·2007-08-12·CVSS 6.8
CVE-2007-4131 [MEDIUM] tar directory traversal vulnerability
tar directory traversal vulnerability
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
Debian
CVE-2007-4131: tar - Directory traversal vulnerability in the contains_dot_dot function in src/names....
vendor_debian·2007·CVSS 6.8
CVE-2007-4131 [MEDIUM] CVE-2007-4131: tar - Directory traversal vulnerability in the contains_dot_dot function in src/names....
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.
Scope: local
bookworm: resolved (fixed in 1.18-2)
bullseye: resolved (fixed in 1.18-2)
forky: resolved (fixed in 1.18-2)
sid: resolved (fixed in 1.18-2)
trixie: resolved (fixed in 1.18-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-4829 perl-Archive-Tar directory traversal flaws
bugzilla·2007-09-18·CVSS 2.1
CVE-2007-4829 [LOW] CVE-2007-4829 perl-Archive-Tar directory traversal flaws
CVE-2007-4829 perl-Archive-Tar directory traversal flaws
Directory traversal vulnerability in Archive::Tar perl module allows
user-assisted remote attackers to overwrite arbitrary files writable by user
running application using this module via an absolute path or a .. (dot dot)
sequence in filenames in a TAR archive.
Similar issues were reported and fixed for GNU tar during past several years,
e.g.: CVE-2001-1267, CVE-2002-0399, CVE-2002-1216 and CVE-2007-4131.
This issue is important when this module is used to extract tar archives from
untrusted sources. However, some of such applications either implement
workarounds / own checks (sa-update in spamassassin) or dropped module support
at all (amavisd-new).
Discussion:
Similar issue was reported for Python's tarfile module, see #26326
Bugzilla
CVE-2007-4131 tar directory traversal vulnerability [FC6]
bugzilla·2007-08-21·CVSS 6.8
CVE-2007-4131 [MEDIUM] CVE-2007-4131 tar directory traversal vulnerability [FC6]
CVE-2007-4131 tar directory traversal vulnerability [FC6]
FC6 tracking bug: see blocks bug list for full details of the security issue(s).
[bug automatically created by: add-tracking-bugs]
Discussion:
tar-1.15.1-26.fc6
Bugzilla
CVE-2007-4131 tar directory traversal vulnerability [F7]
bugzilla·2007-08-21·CVSS 6.8
CVE-2007-4131 [MEDIUM] CVE-2007-4131 tar directory traversal vulnerability [F7]
CVE-2007-4131 tar directory traversal vulnerability [F7]
F7 tracking bug: see blocks bug list for full details of the security issue(s).
[bug automatically created by: add-tracking-bugs]
Discussion:
tar-1.15.1-27.fc7
---
tar-1.15.1-27.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
Bugzilla
CVE-2007-4131 tar directory traversal vulnerability
bugzilla·2007-08-13·CVSS 6.8
CVE-2007-4131 [MEDIUM] CVE-2007-4131 tar directory traversal vulnerability
CVE-2007-4131 tar directory traversal vulnerability
Directory traversal vulnerability was discovered in GNU tar. Vulnerability can
be exploited by specially crafted tar archive to overwrite arbitrary file
writable by user running tar. Problem occurs in contains_dot_dot function,
which does not properly check names of directory symlinks.
Acknowledgements:
Red Hat would like to thank Dmitry V. Levin for reporting this issue.
Discussion:
Created attachment 161175
contains_dot_dot patch
Patch by Dmitry V. Levin used by Owl.
---
Patch is in upstream cvs, embargo removed.
---
This issue did not affect tar packages as distributed with Red Hat
Enterprise Linux 2.1 or 3.
---
Issue fixed on all supported platforms, closing Security Response bug.
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=251921http://docs.info.apple.com/article.html?artnum=307179http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlhttp://secunia.com/advisories/26573http://secunia.com/advisories/26590http://secunia.com/advisories/26603http://secunia.com/advisories/26604http://secunia.com/advisories/26655http://secunia.com/advisories/26673http://secunia.com/advisories/26674http://secunia.com/advisories/26781http://secunia.com/advisories/26822http://secunia.com/advisories/26984http://secunia.com/advisories/27453http://secunia.com/advisories/27861http://secunia.com/advisories/28136http://secunia.com/advisories/28255http://security.FreeBSD.org/advisories/FreeBSD-SA-07:10.gtar.aschttp://security.gentoo.org/glsa/glsa-200709-09.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-77-1021680.1-1http://support.avaya.com/elmodocs2/security/ASA-2007-383.htmhttp://www.debian.org/security/2007/dsa-1438http://www.mandriva.com/security/advisories?name=MDKSA-2007:173http://www.novell.com/linux/security/advisories/2007_18_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0860.htmlhttp://www.securityfocus.com/archive/1/477731/100/0/threadedhttp://www.securityfocus.com/archive/1/477865/100/0/threadedhttp://www.securityfocus.com/bid/25417http://www.securitytracker.com/id?1018599http://www.trustix.org/errata/2007/0026/http://www.ubuntu.com/usn/usn-506-1http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlhttp://www.vupen.com/english/advisories/2007/2958http://www.vupen.com/english/advisories/2007/4238https://issues.rpath.com/browse/RPL-1631https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10420https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7779https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00370.htmlhttp://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=251921http://docs.info.apple.com/article.html?artnum=307179http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlhttp://secunia.com/advisories/26573http://secunia.com/advisories/26590http://secunia.com/advisories/26603http://secunia.com/advisories/26604http://secunia.com/advisories/26655http://secunia.com/advisories/26673http://secunia.com/advisories/26674http://secunia.com/advisories/26781http://secunia.com/advisories/26822http://secunia.com/advisories/26984http://secunia.com/advisories/27453http://secunia.com/advisories/27861http://secunia.com/advisories/28136http://secunia.com/advisories/28255http://security.FreeBSD.org/advisories/FreeBSD-SA-07:10.gtar.aschttp://security.gentoo.org/glsa/glsa-200709-09.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-77-1021680.1-1http://support.avaya.com/elmodocs2/security/ASA-2007-383.htmhttp://www.debian.org/security/2007/dsa-1438http://www.mandriva.com/security/advisories?name=MDKSA-2007:173http://www.novell.com/linux/security/advisories/2007_18_sr.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0860.htmlhttp://www.securityfocus.com/archive/1/477731/100/0/threadedhttp://www.securityfocus.com/archive/1/477865/100/0/threadedhttp://www.securityfocus.com/bid/25417http://www.securitytracker.com/id?1018599http://www.trustix.org/errata/2007/0026/http://www.ubuntu.com/usn/usn-506-1http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlhttp://www.vupen.com/english/advisories/2007/2958http://www.vupen.com/english/advisories/2007/4238https://issues.rpath.com/browse/RPL-1631https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10420https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7779https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00370.html
2007-08-25
Published