CVE-2018-20482 GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c)....
MediumCVSS 4.7
EPSS 0.53%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/tar(Debian:12) | < 1.30+dfsg-3.1 | 1.30+dfsg-3.1 |
| debian/tar(Debian:13) | < 1.30+dfsg-3.1 | 1.30+dfsg-3.1 |
| debian/tar(Debian:14) | < 1.30+dfsg-3.1 | 1.30+dfsg-3.1 |
| alpine/tar(Alpine:v3.10) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.11) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.12) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.13) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.14) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.15) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.16) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.17) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.18) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.19) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.20) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.21) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.22) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.23) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.24) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.6) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.7) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.8) | < 1.31-r0 | 1.31-r0 |
| alpine/tar(Alpine:v3.9) | < 1.31-r0 | 1.31-r0 |
| Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU tar | <= 1.30 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-20482 vendor-advisory
- security.alpinelinux.org vendor-advisory
- utcc.utoronto.ca patch third-party-advisory
- git.savannah.gnu.org patch third-party-advisory
- [debian-lts-announce] 20181231 [SECURITY] [DLA 1623-1] tar security update mailing-list third-party-advisory
- news.ycombinator.com exploit third-party-advisory
- 106354 third-party-advisory vdb-entry
- GLSA-201903-05 third-party-advisory vendor-advisory
- lists.gnu.org third-party-advisory
- twitter.com patch third-party-advisory
- openSUSE-SU-2019:1237 mailing-list third-party-advisory vendor-advisory
- [debian-lts-announce] 20211128 [SECURITY] [DLA 2830-1] tar security update mailing-list third-party-advisory
- cert-portal.siemens.com
- bugs.debian.org issue-tracking