CVE-2006-6097 GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not...
MediumCVSS 4.0
EPSS 11.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU tar | = 1.15.1 | No fix listed |
| GNU tar | = 1.16 | No fix listed |
| debian/tar(Debian:12) | < 1.16-2 | 1.16-2 |
| debian/tar(Debian:13) | < 1.16-2 | 1.16-2 |
| debian/tar(Debian:14) | < 1.16-2 | 1.16-2 |
References
- Debian Security Tracker CVE-2006-6097 vendor-advisory
- bugs.debian.org issue-tracking
- docs.info.apple.com
- kb.vmware.com
- APPLE-SA-2007-03-13 vendor-advisory
- 20061121 GNU tar directory traversal exploit mailing-list
- RHSA-2006:0749 vendor-advisory
- 23115 third-party-advisory
- 23117 third-party-advisory
- 23142 third-party-advisory
- 23146 third-party-advisory
- 23163 third-party-advisory
- 23173 third-party-advisory
- 23198 third-party-advisory
- 23209 third-party-advisory
- 23314 third-party-advisory
- 23443 third-party-advisory
- 23514 third-party-advisory
- 23911 third-party-advisory
- 24479 third-party-advisory
- 24636 third-party-advisory
- FreeBSD-SA-06:26 vendor-advisory
- GLSA-200612-10 vendor-advisory
- 1918 third-party-advisory
- 1017423 vdb-entry
- SSA:2006-335-01 vendor-advisory
- support.avaya.com
- DSA-1223 vendor-advisory
- MDKSA-2006:219 vendor-advisory
- OpenPKG-SA-2006.038 vendor-advisory
- 20061201 rPSA-2006-0222-1 tar mailing-list
- 20070330 VMSA-2007-0002 VMware ESX security updates mailing-list
- 21235 exploit vdb-entry
- 2006-0068 vendor-advisory
- USN-385-1 vendor-advisory
- TA07-072A third-party-advisory us-government-resource
- www.vmware.com
- ADV-2006-4717 vdb-entry
- ADV-2006-5102 vdb-entry
- ADV-2007-0930 vdb-entry
- ADV-2007-1171 vdb-entry
- bugzilla.redhat.com exploit
- issues.rpath.com
- oval:org.mitre.oval:def:10963 signature vdb-entry