CVE-2019-9923
published 2019-03-22CVE-2019-9923: pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
PriorityP335high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
3.03%
85.9th percentile
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tar | < tar 1.32+dfsg-1 (bookworm) | tar 1.32+dfsg-1 (bookworm) |
| gnu | tar | < 1.32 | 1.32 |
| gnu | tar | >= 0 < 1.32+dfsg-1 | 1.32+dfsg-1 |
| gnu | tar | >= 0 < 1.32+dfsg-1 | 1.32+dfsg-1 |
| gnu | tar | >= 0 < 1.32+dfsg-1 | 1.32+dfsg-1 |
| gnu | tar | >= 0 < 1.32+dfsg-1 | 1.32+dfsg-1 |
| gnu | tar | >= 0 < 1.28-2.1ubuntu0.2 | 1.28-2.1ubuntu0.2 |
| gnu | tar | >= 0 < 1.29b-2ubuntu0.2 | 1.29b-2ubuntu0.2 |
| gnu | tar | >= 0 < 1.30+dfsg-7ubuntu0.20.04.1 | 1.30+dfsg-7ubuntu0.20.04.1 |
| gnu | tar | >= 0 < 1.27.1-1ubuntu0.1+esm1 | 1.27.1-1ubuntu0.1+esm1 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mg5f-88x3-g9cw: pax_decode_header in sparse
ghsa_unreviewed·2022-05-13
CVE-2019-9923 [HIGH] CWE-476 GHSA-mg5f-88x3-g9cw: pax_decode_header in sparse
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
OSV
tar vulnerabilities
osv·2021-01-13·CVSS 4.7
CVE-2018-20482 [MEDIUM] tar vulnerabilities
tar vulnerabilities
Chris Siebenmann discovered that tar incorrectly handled extracting files
resized during extraction when invoked with the --sparse flag. An attacker
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2018-20482)
Daniel Axtens discovered that tar incorrectly handled certain malformed
tar files. If a user or automated system were tricked into processing a
specially crafted tar archive, a remote attacker could use this issue to
cause tar to crash, resulting in a denial of service. (CVE-2019-9923)
OSV
CVE-2019-9923: pax_decode_header in sparse
osv·2019-03-22·CVSS 7.5
CVE-2019-9923 [HIGH] CVE-2019-9923: pax_decode_header in sparse
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
CISA ICS
Rockwell Automation DataMosaix Private Cloud
cisa_ics·2024-10-10·CVSS 7.5
[HIGH] Rockwell Automation DataMosaix Private Cloud
ICS Advisory
##
Rockwell Automation DataMosaix Private Cloud
Release DateOctober 10, 2024
Alert CodeICSA-24-284-16
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.3
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Rockwell Automation
- Equipment: DataMosaix Private Cloud
- Vulnerabilities: Inadequate Encryption Strength, Out-of-bounds Write, Improper Check for Dropped Privileges, Reliance on Insufficiently Trustworthy Component, NULL Pointer Dereference
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could cause a denial-of-service condition, view user data, or perform remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTE
Ubuntu
tar vulnerabilities
vendor_ubuntu·2021-01-13·CVSS 4.7
CVE-2018-20482 [MEDIUM] tar vulnerabilities
Title: tar vulnerabilities
Summary: Several security issues were fixed in tar.
Chris Siebenmann discovered that tar incorrectly handled extracting files
resized during extraction when invoked with the --sparse flag. An attacker
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM, Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2018-20482)
Daniel Axtens discovered that tar incorrectly handled certain malformed
tar files. If a user or automated system were tricked into processing a
specially crafted tar archive, a remote attacker could use this issue to
cause tar to crash, resulting in a denial of service. (CVE-2019-9923)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
tar: null-pointer dereference in pax_decode_header in sparse.c
vendor_redhat·2019-01-02·CVSS 7.5
CVE-2019-9923 [HIGH] CWE-476 tar: null-pointer dereference in pax_decode_header in sparse.c
tar: null-pointer dereference in pax_decode_header in sparse.c
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Statement: This issue is classified with a low severity primarily because untrusted tar files are not typically extracted with the root user, limiting the impact of this issue. Additionally, this NULL pointer dereference is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with tar. Furthermore, tar does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting
Debian
CVE-2019-9923: tar - pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer derefere...
vendor_debian·2019·CVSS 7.5
CVE-2019-9923 [HIGH] CVE-2019-9923: tar - pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer derefere...
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Scope: local
bookworm: resolved (fixed in 1.32+dfsg-1)
bullseye: resolved (fixed in 1.32+dfsg-1)
forky: resolved (fixed in 1.32+dfsg-1)
sid: resolved (fixed in 1.32+dfsg-1)
trixie: resolved (fixed in 1.32+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-9923 tar: null-pointer dereference in pax_decode_header in sparse.c [fedora-all]
bugzilla·2019-03-22·CVSS 7.5
CVE-2019-9923 [HIGH] CVE-2019-9923 tar: null-pointer dereference in pax_decode_header in sparse.c [fedora-all]
CVE-2019-9923 tar: null-pointer dereference in pax_decode_header in sparse.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppor
Bugzilla
CVE-2019-9923 tar: null-pointer dereference in pax_decode_header in sparse.c
bugzilla·2019-03-22·CVSS 7.5
CVE-2019-9923 [HIGH] CVE-2019-9923 tar: null-pointer dereference in pax_decode_header in sparse.c
CVE-2019-9923 tar: null-pointer dereference in pax_decode_header in sparse.c
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.
Reference:
https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241
Upstream commit:
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120
Discussion:
Created tar tracking bugs for this issue:
Affects: fedora-all [bug 1691765]
---
Function pax_decode_header() in sparse.c does not check if there is a next block before using it, thus some malformed tar files could cause an application crash.
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.htmlhttp://savannah.gnu.org/bugs/?55369https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Ehttp://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.htmlhttp://savannah.gnu.org/bugs/?55369https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
2019-03-22
Published