USN-709-1: tar vulnerability


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) USN-709-1: tar vulnerability
# 1  
Old 01-15-2009
USN-709-1: tar vulnerability

Referenced CVEs:
CVE-2007-4476


Description:
=========================================================== Ubuntu Security Notice USN-709-1 January 15, 2009 tar vulnerability CVE-2007-4476 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: tar 1.15.1-2ubuntu2.3 Ubuntu 7.10: tar 1.18-2ubuntu1.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Dmitry V. Levin discovered a buffer overflow in tar. If a user or automatated system were tricked into opening a specially crafted tar file, an attacker could crash tar or possibly execute arbitrary code with the privileges of the user invoking the program.





More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
tar(4)							     Kernel Interfaces Manual							    tar(4)

NAME
tar - format of tar tape archive DESCRIPTION
The header structure produced by (see tar(1)) is as follows (the array size defined by the constants is shown on the right): All characters are represented in ASCII. There is no padding used in the header block; all fields are contiguous. The fields magic, uname, and gname are null-terminated character strings. The fields name, linkname, and prefix are null-terminated char- acter strings except when all characters in the array contain non-null characters, including the last character. The version field is two bytes containing the characters (zero-zero). The typeflag contains a single character. All other fields are leading-zero-filled octal numbers in ASCII. Each numeric field is terminated by one or more space or null characters. The name and the prefix fields produce the pathname of the file. The hierarchical relationship of the file is retained by specifying the pathname as a path prefix, with a slash character and filename as the suffix. If the prefix contains non-null characters, prefix, a slash character, and name are concatenated without modification or addition of new characters to produce a new pathname. In this manner, path- names of at most 256 characters can be supported. If a pathname does not fit in the space provided, the format-creating utility notifies the user of the error, and no attempt is made to store any part of the file, header, or data on the medium. SEE ALSO
tar(1) STANDARDS CONFORMANCE
tar(4)