tar vulnerability

2006-11-2700:00:00

ubuntu.com

6.3 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:N/I:P/A:P

0.01 Low

EPSS

Percentile

83.6%

JSON

Releases

Ubuntu 6.10
Ubuntu 6.06
Ubuntu 5.10

Details

Teemu Salmela discovered that tar still handled the deprecated
GNUTYPE_NAMES record type. This record type could be used to create
symlinks that would be followed while unpacking a tar archive. If a
user or an automated system were tricked into unpacking a specially
crafted tar file, arbitrary files could be overwritten with user
privileges.

OSVersionArchitecturePackageVersionFilename
Ubuntu6.10noarchtar< 1.15.91-2ubuntu0.3UNKNOWN
Ubuntu6.06noarchtar< 1.15.1-2ubuntu2.1UNKNOWN
Ubuntu5.10noarchtar< 1.15.1-2ubuntu0.2UNKNOWN