CVE-2018-20482
published 2018-12-26CVE-2018-20482: GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read…
PriorityP415medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.53%
41.0th percentile
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | tar | < tar 1.30+dfsg-3.1 (bookworm) | tar 1.30+dfsg-3.1 (bookworm) |
| gnu | tar | <= 1.30 | — |
| gnu | tar | >= 0 < 1.30+dfsg-3.1 | 1.30+dfsg-3.1 |
| gnu | tar | >= 0 < 1.30+dfsg-3.1 | 1.30+dfsg-3.1 |
| gnu | tar | >= 0 < 1.30+dfsg-3.1 | 1.30+dfsg-3.1 |
| gnu | tar | >= 0 < 1.30+dfsg-3.1 | 1.30+dfsg-3.1 |
| gnu | tar | >= 0 < 1.28-2.1ubuntu0.2 | 1.28-2.1ubuntu0.2 |
| gnu | tar | >= 0 < 1.29b-2ubuntu0.2 | 1.29b-2ubuntu0.2 |
| gnu | tar | >= 0 < 1.30+dfsg-7ubuntu0.20.04.1 | 1.30+dfsg-7ubuntu0.20.04.1 |
| gnu | tar | >= 0 < 1.27.1-1ubuntu0.1+esm1 | 1.27.1-1ubuntu0.1+esm1 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:N/I:N/A:P
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pm5x-48pq-67cq: GNU Tar through 1
ghsa_unreviewed·2022-05-13
CVE-2018-20482 [MEDIUM] CWE-835 GHSA-pm5x-48pq-67cq: GNU Tar through 1
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
OSV
tar vulnerabilities
osv·2021-01-13·CVSS 4.7
CVE-2018-20482 [MEDIUM] tar vulnerabilities
tar vulnerabilities
Chris Siebenmann discovered that tar incorrectly handled extracting files
resized during extraction when invoked with the --sparse flag. An attacker
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2018-20482)
Daniel Axtens discovered that tar incorrectly handled certain malformed
tar files. If a user or automated system were tricked into processing a
specially crafted tar archive, a remote attacker could use this issue to
cause tar to crash, resulting in a denial of service. (CVE-2019-9923)
OSV
CVE-2018-20482: GNU Tar through 1
osv·2018-12-26·CVSS 4.7
CVE-2018-20482 [MEDIUM] CVE-2018-20482: GNU Tar through 1
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Ubuntu
tar vulnerabilities
vendor_ubuntu·2021-01-13·CVSS 4.7
CVE-2018-20482 [MEDIUM] tar vulnerabilities
Title: tar vulnerabilities
Summary: Several security issues were fixed in tar.
Chris Siebenmann discovered that tar incorrectly handled extracting files
resized during extraction when invoked with the --sparse flag. An attacker
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2018-20482)
Daniel Axtens discovered that tar incorrectly handled certain malformed
tar files. If a user or automated system were tricked into processing a
specially crafted tar archive, a remote attacker could use this issue to
cause tar to crash, resulting in a denial of service. (CVE-2019-9923)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
tar: Infinite read loop in sparse_dump_region function in sparse.c
vendor_redhat·2018-12-26·CVSS 4.7
CVE-2018-20482 [MEDIUM] CWE-835 tar: Infinite read loop in sparse_dump_region function in sparse.c
tar: Infinite read loop in sparse_dump_region function in sparse.c
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability because ships already patched version of tar.
Package: tar (Red Hat Enterprise Linux 5) - Will not fix
Package: tar (Red Hat Enterprise Linux 6) - Will not fix
Package: tar (Red Hat Enterprise Linux 7) - Will not fix
Package: tar (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2018-20482: tar - GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during re...
vendor_debian·2018·CVSS 4.7
CVE-2018-20482 [MEDIUM] CVE-2018-20482: tar - GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during re...
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
Scope: local
bookworm: resolved (fixed in 1.30+dfsg-3.1)
bullseye: resolved (fixed in 1.30+dfsg-3.1)
forky: resolved (fixed in 1.30+dfsg-3.1)
sid: resolved (fixed in 1.30+dfsg-3.1)
trixie: resolved (fixed in 1.30+dfsg-3.1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-20482 tar: Infinite read loop in sparse_dump_region function in sparse.c [fedora-all]
bugzilla·2018-12-27·CVSS 4.7
CVE-2018-20482 [MEDIUM] CVE-2018-20482 tar: Infinite read loop in sparse_dump_region function in sparse.c [fedora-all]
CVE-2018-20482 tar: Infinite read loop in sparse_dump_region function in sparse.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2018-20482 tar: Infinite read loop in sparse_dump_region function in sparse.c
bugzilla·2018-12-27·CVSS 4.7
CVE-2018-20482 [MEDIUM] CVE-2018-20482 tar: Infinite read loop in sparse_dump_region function in sparse.c
CVE-2018-20482 tar: Infinite read loop in sparse_dump_region function in sparse.c
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
References:
https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug
Upstream patch:
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42c
Discussion:
Created tar tracking bugs for this issue:
Affects: fedora-all [bug 1662347]
---
See https://www.mail-archive.com/[email protected]/msg04432.html
---
A different patch from the one mentioned in comment 0 has been a
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.htmlhttp://www.securityfocus.com/bid/106354https://lists.debian.org/debian-lts-announce/2018/12/msg00023.htmlhttps://lists.debian.org/debian-lts-announce/2021/11/msg00025.htmlhttps://news.ycombinator.com/item?id=18745431https://security.gentoo.org/glsa/201903-05https://twitter.com/thatcks/status/1076166645708668928https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBughttp://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.htmlhttp://www.securityfocus.com/bid/106354https://lists.debian.org/debian-lts-announce/2018/12/msg00023.htmlhttps://lists.debian.org/debian-lts-announce/2021/11/msg00025.htmlhttps://news.ycombinator.com/item?id=18745431https://security.gentoo.org/glsa/201903-05https://twitter.com/thatcks/status/1076166645708668928https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug
2018-12-26
Published