GNU tar extract pathname bypass

by wrl on 10/27/2016, 12:17 PM with 7 comments
  • by joeyh on 10/27/2016, 5:18 PM

    This reminds me of a over 10 year old security hole I noticed in tar: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=290435

  • by rurban on 10/27/2016, 5:46 PM

    How come the GNU tar maintainer was ignoring this for 6 months? Shouldn't someone better take over then? Huge fail.

  • by cyphar on 10/28/2016, 3:42 AM

    I'd say that the issue is only a vulnerability if you're doing tar -C / (which would be dumb). The actual issue appears to be that the filtering features of GNU tar are applied before pathname sanitisation (which is the actual security bug). The title (and some of the wording in the disclosure) lead me to believe that GNU tar would let you extract to paths outside the -C directory (which would be very bad).

    So I kinda see the PoV of the maintainer, though I don't agree with the filter ordering.

  • by d33 on 10/27/2016, 3:54 PM

    Interesting. I wonder if this kind of bugs could be found automatically, via fuzzing. It would be nice if someone found a way to add a definition of unexpected behavior to fuzzing with AFL...

  • by trendia on 10/27/2016, 7:16 PM

    Linux is supposedly secure because everyone can access the source code and find a serious bug.

    The question is whether anyone will fix it.