Sponsored Content
Full Discussion: USN-709-1: tar vulnerability
Special Forums Cybersecurity Security Advisories (RSS) USN-709-1: tar vulnerability Post 302277215 by Linux Bot on Thursday 15th of January 2009 05:10:03 PM
Old 01-15-2009
USN-709-1: tar vulnerability

Referenced CVEs:
CVE-2007-4476


Description:
=========================================================== Ubuntu Security Notice USN-709-1 January 15, 2009 tar vulnerability CVE-2007-4476 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: tar 1.15.1-2ubuntu2.3 Ubuntu 7.10: tar 1.18-2ubuntu1.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Dmitry V. Levin discovered a buffer overflow in tar. If a user or automatated system were tricked into opening a specially crafted tar file, an attacker could crash tar or possibly execute arbitrary code with the privileges of the user invoking the program.





More...
 
pbput(1)							     bikeshed								  pbput(1)

NAME
pbput - compress and encode arbitrary files to pastebin.com pbputs - compress, encrypt, encode arbitrary files to pastebin.com pbget - decode and decompress arbitrary files from pastebin.com SYNOPSIS
pbput [FILENAME] cat foo | pbput pbputs [FILENAME] [GPG_USER] cat foo | pbputs [GPG_USER] pbget URL [DIRECTORY] DESCRIPTION
pbput is a program that can upload text files, binary files or entire directory structures to a pastebin, such as pastebin.com. pbget is a program that be used to retrieve content uploaded to a pastebin by pbput. pbputs operates exactly like pbput, except it encrypts the data. An optional GPG_USER argument is allowed, which will sign and encrypt the data to the target user in one's keyring (which could be oneself!). Otherwise, the user is prompted for a symmetric passphrase for encrypting the content with gpg(1) before uploading. pbget will automatically prompt the receiving user for the pre-shared passphrase. pbput and pbputs can take its input either on STDIN, or as a FILENAME argument. - If STDIN is used, then the receiving user's pbget will simply paste the input on STDOUT. - If a FILENAME or DIRECTORY is passed as an argument, then it is first archived using tar(1) to preserve the file and directory attributes pbget takes a URL as its first, mandatory argument. Optionally, it takes a DIRECTORY as a second parameter. If the incoming data is in fact a file or file structure in a tar(1) archive, then that data will be extracted in the specified DIRECTORY. If no DIRECTORY is speci- fied, then a temporary directory is created using mktemp(1). In any case the uploaded/downloaded data is optionally tar(1) archived, always lzma(1) compressed, optionally gpg(1) encrypted, and always base64(1) encoded. http://pastebin.com is used by default. EXAMPLES
$ pbput /sbin/init http://pastebin.com/BstNzasK $ pbget http://pastebin.com/BstNzasK sbin/init INFO: Output is in [/tmp/pbget.bG67DwY6Zl] $ cat /etc/lsb-release | pbput http://pastebin.com/p43gJv6Z $ pbget http://pastebin.com/p43gJv6Z DISTRIB_ID=Ubuntu DISTRIB_RELEASE=11.04 DISTRIB_CODENAME=natty DISTRIB_DESCRIPTION="Ubuntu 11.04" $ pbputs /etc/shadow Enter passphrase: http://pastebin.com/t2ZaCYr3 $ pbget http://pastebin.com/t2ZaCYr3 Enter passphrase: root:09cc6d2d9d63371a425076e217f77698:15096:0:99999:7::: daemon:*:15089:0:99999:7::: bin:*:15089:0:99999:7::: sys:*:15089:0:99999:7::: .... SEE ALSO
pastebinit(1), lzma(1), base64(1), tar(1), gpg(1), mktemp(1) AUTHOR
This manpage and the utility was written by Dustin Kirkland <kirkland@ubuntu.com> for Ubuntu systems (but may be used by others). Permis- sion is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or later pub- lished by the Free Software Foundation. On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL, or on the web at http://www.gnu.org/licenses/gpl.txt. bikeshed 6 Oct 2010 pbput(1)
All times are GMT -4. The time now is 11:43 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy