Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly...

CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

DEBIAN-CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

CVE-2006-6097

Summary: CVE-2006-6097 affects GNU tar (notably v1.15.1 and v1.16) due to improper handling of GNUTYPE_NAMES symlink records during extraction, enabling a user-assisted attacker to overwrite arbitrary files. Multiple advisories report the issue as a path-traversal vulnerability in tar extraction,...

CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

CVE-2006-6097

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPENAMES record with a symbolic link, which is not properly handled by the extractarchive function in extract.c and extractmangle function in...

gnutar.txt

GNU tar directory traversal ---------------------------------------------------------------------------- What is it? When i download a tar file warez.tar.gz in this example from the web and run the following commands: $ mkdir /warez $ tar xzf warez.tar.gz -C /warez , then i would expect that tar...

GNU Tar 1.1x - GNUTYPE_NAMES Directory Traversal

GNU Tar 1.1x - GNUTYPENAMES Directory Traversal / source: https://www.securityfocus.com/bid/21235/info GNU Tar is prone to a vulnerability that may allow an attacker to place files and overwrite files in arbitrary locations on a vulnerable computer. These issues present themselves when the...

GNU Tar 1.1x - 'GNUTYPE_NAMES' Directory Traversal

/ source: https://www.securityfocus.com/bid/21235/info GNU Tar is prone to a vulnerability that may allow an attacker to place files and overwrite files in arbitrary locations on a vulnerable computer. These issues present themselves when the application processes malicious archives. A successful...

Debian DSA-987-1 : tar - buffer overflow

Jim Meyering discovered several buffer overflows in GNU tar, which may lead to the execution of arbitrary code through specially crafted tar archives. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

CVE-2006-4663

The CVE-2006-4663 entry concerns weak permissions (0666/0777) in the Linux kernel source tarballs for 2.6.16 through 2.6.17.11, potentially allowing a local user to insert Trojan horse source code that could be used when the kernel is next compiled. Primary details from connected documents indica...

CentOS 4 : tar (CESA-2006:0232)

An updated tar package that fixes a buffer overflow bug is now available for Red Hat Enterprise Linux 4. This update has been rated as having Moderate security impact by the Red Hat Security Response Team. The GNU tar program saves many files together in one archive and can restore individual fil...

CentOS 3 : tar (CESA-2006:0195)

An updated tar package that fixes a path traversal flaw is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU tar program saves many files together in one archive and can restore individual files or all of the files from that...

CVE-2006-3326

The CVE-2006-3326 entry describes a directory-traversal vulnerability in QuickZip 3.06.3 where remote attacker-controlled dot-dot sequences in filenames inside TAR, GZ, and JAR archives can cause overwriting of arbitrary files or directories. The root cause is improper handling of archive filenam...

Directory traversal

Directory traversal vulnerability in FilZip 3.05 allows remote attackers to write arbitrary files via a .. dot dot in a 1 .rar, 2 .tar, 3 .jar, or 4 .gz file. NOTE: the provenance of this information is unknown; the details are obtained from third party information...

BitZipper Archive Extraction Directory traversal

BitZipper Archive Extraction Directory traversal BitZipper is an advanced data compression tool for Windows that enables you to unzip 18 different compression and encoding formats with superior ease-of-use. Create 8 different types of compressed files http://www.bitzipper.com Credit: The...

CVE-2006-2520

Directory traversal vulnerability in BitZipper 4.1.2 SR-1 and earlier allows remote attackers to create files in arbitrary directories via a .. dot dot in the filename of a file that is stored in a 1 RAR .rar, 2 TAR .tar, 3 ZIP .zip, 4 GZ .gz, or 5 JAR .jar archive...

CVE-2006-2520

CVE-2006-2520 affects BitZipper (versions up to and including 4.1.2 SR-1). The flaw is a directory traversal in archive handling: a filename within a stored archive (RAR, TAR, ZIP, GZ, JAR) can contain a .. sequence, enabling an attacker to create files in arbitrary directories on the host. This ...

Directory traversal

Multiple directory traversal vulnerabilities in IZArc Archiver 3.5 beta 3 allow remote attackers to write arbitrary files via a ..\ dot dot backslash in a 1 .rar, 2 .tar, 3 .zip, 4 .jar, or 5 .gz archive. NOTE: the provenance of this information is unknown; the details are obtained solely from...