CVE-2016-6321

Name
CVE-2016-6321
Description
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Issue Tracking http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d
Mailing List http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html
Exploit http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html
Mailing List http://seclists.org/fulldisclosure/2016/Oct/102
Mailing List http://seclists.org/fulldisclosure/2016/Oct/96
secalert@redhat.com http://www.debian.org/security/2016/dsa-3702
Third Party Advisory http://www.securityfocus.com/bid/93937
secalert@redhat.com http://www.ubuntu.com/usn/USN-3132-1
secalert@redhat.com https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
secalert@redhat.com https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
secalert@redhat.com https://security.gentoo.org/glsa/201611-19
Third Party Advisory https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnu:tar:1.14:*:*:*:*:*:*:* tar == None == 1.14
cpe:2.3:a:gnu:tar:1.15:*:*:*:*:*:*:* tar == None == 1.15
cpe:2.3:a:gnu:tar:1.15.1:*:*:*:*:*:*:* tar == None == 1.15.1
cpe:2.3:a:gnu:tar:1.15.90:*:*:*:*:*:*:* tar == None == 1.15.90
cpe:2.3:a:gnu:tar:1.15.91:*:*:*:*:*:*:* tar == None == 1.15.91
cpe:2.3:a:gnu:tar:1.16:*:*:*:*:*:*:* tar == None == 1.16
cpe:2.3:a:gnu:tar:1.16.1:*:*:*:*:*:*:* tar == None == 1.16.1
cpe:2.3:a:gnu:tar:1.17:*:*:*:*:*:*:* tar == None == 1.17
cpe:2.3:a:gnu:tar:1.18:*:*:*:*:*:*:* tar == None == 1.18
cpe:2.3:a:gnu:tar:1.19:*:*:*:*:*:*:* tar == None == 1.19
cpe:2.3:a:gnu:tar:1.20:*:*:*:*:*:*:* tar == None == 1.20
cpe:2.3:a:gnu:tar:1.21:*:*:*:*:*:*:* tar == None == 1.21
cpe:2.3:a:gnu:tar:1.22:*:*:*:*:*:*:* tar == None == 1.22
cpe:2.3:a:gnu:tar:1.23:*:*:*:*:*:*:* tar == None == 1.23
cpe:2.3:a:gnu:tar:1.24:*:*:*:*:*:*:* tar == None == 1.24
cpe:2.3:a:gnu:tar:1.25:*:*:*:*:*:*:* tar == None == 1.25
cpe:2.3:a:gnu:tar:1.26:*:*:*:*:*:*:* tar == None == 1.26
cpe:2.3:a:gnu:tar:1.27:*:*:*:*:*:*:* tar == None == 1.27
cpe:2.3:a:gnu:tar:1.27.1:*:*:*:*:*:*:* tar == None == 1.27.1
cpe:2.3:a:gnu:tar:1.28:*:*:*:*:*:*:* tar == None == 1.28
cpe:2.3:a:gnu:tar:1.29:*:*:*:*:*:*:* tar == None == 1.29

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
tar edge-main 1.29-r1 None fixed
tar 3.22-main 1.29-r1 None fixed
tar 3.21-main 1.29-r1 None fixed
tar 3.20-main 1.29-r1 None fixed
tar 3.19-main 1.29-r1 None fixed
tar 3.18-main 1.29-r1 None fixed
tar 3.17-main 1.29-r1 None fixed
tar 3.12-main 1.29-r1 None fixed
tar 3.11-main 1.29-r1 None fixed
tar 3.10-main 1.29-r1 None fixed