Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-4476

CWE-119 — Buffer Overflow12 documents9 sources
Severity
7.5HIGH
EPSS
11.8%
top 6.28%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
GNU TARCanonical Ubuntu LinuxDebian Debian Linux
Timeline
PublishedSep 5
Latest updateMay 1

Description

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶NVDgnu/tar< 1.19
▶Debiantar< 1.18-1+3
▶Debiancpio< 2.9-5+3

Also affects: Debian Linux 3.1, 4.0, Ubuntu Linux 6.06, 7.04, 7.10

Patches

Patch: secunia.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qc9f-9qmm-9663: Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack↗2022-05-01
▶
OSV
CVE-2007-4476: Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack↗2007-09-05
▶
CVEList
CVE-2007-4476: Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack↗2007-09-05
▶

💥Exploits & PoCs

1
Exploit-DB
GNU TAR 1.15.91 / CPIO 2.5.90 - 'safer_name_suffix' Remote Denial of Service↗2007-11-14
▶

📋Vendor Advisories

4
Ubuntu
tar vulnerability↗2009-01-15
▶
Ubuntu
cpio vulnerability↗2008-10-02
▶
Red Hat
tar/cpio stack crashing in safer_name_suffix↗2007-08-17
▶
Debian
CVE-2007-4476: cpio - Buffer overflow in the safer_name_suffix function in GNU tar has unspecified att...↗2007
▶

💬Community

3
Bugzilla
CVE-2007-4476 cpio stack crashing in safer_name_suffix [Fdevel]↗2007-10-19
▶
Bugzilla
CVE-2007-4476 tar stack crashing in safer_name_suffix [Fdevel]↗2007-10-19
▶
Bugzilla
CVE-2007-4476 tar/cpio stack crashing in safer_name_suffix↗2007-09-06
▶