Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2007-4131

Published: 25/08/2007 Updated: 15/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Enterprise Linux Desktop

Vulnerability Summary

Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote malicious users to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

Vulnerable Product Search on Vulmon Subscribe to Product

gnu tar 1.13.19

gnu tar 1.13.25

gnu tar 1.15.91

gnu tar 1.16

gnu tar 1.13

gnu tar 1.13.5

gnu tar 1.14

gnu tar 1.13.16

gnu tar 1.13.17

gnu tar 1.13.18

gnu tar 1.15.1

gnu tar 1.15.90

gnu tar 1.13.11

gnu tar 1.13.14

gnu tar 1.14.90

gnu tar 1.15

Vendor Advisories

Ubuntu Security Notice: tar vulnerability
Dmitry V Levin discovered that tar did not correctly detect the “” file path element when unpacking archives If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary files could be overwritten with user privileges ...
Debian CVElist Bug Report Logs: CVE-2007-4476 Buffer overflow in the safer_name_suffix function
Debian Bug report logs - #441444 CVE-2007-4476 Buffer overflow in the safer_name_suffix function Package: tar; Maintainer for tar is Bdale Garbee <bdale@gagcom>; Source for tar is src:tar (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: Sun, 9 Sep 2007 21:00:01 UTC Severity: normal Tags: patch ...
Debian CVElist Bug Report Logs: CVE-2007-4131: GNU tar Directory Traversal Vulnerability
Debian Bug report logs - #439335 CVE-2007-4131: GNU tar Directory Traversal Vulnerability Package: tar; Maintainer for tar is Bdale Garbee <bdale@gagcom>; Source for tar is src:tar (PTS, buildd, popcon) Reported by: Luca Bruno <lucabr@unoit> Date: Fri, 24 Aug 2007 09:42:02 UTC Severity: important Tags: patch, sec ...
Debian Security Advisories: DSA-1438-1 tar -- several vulnerabilities
Several vulnerabilities have been discovered in GNU Tar The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-4131 A directory traversal vulnerability enables attackers using specially crafted archives to extract contents outside the directory tree created by tar CVE-2007-4476 ...

References

NVD-CWE-Otherhttp://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=251921http://www.redhat.com/support/errata/RHSA-2007-0860.htmlhttp://www.securityfocus.com/bid/25417https://issues.rpath.com/browse/RPL-1631http://support.avaya.com/elmodocs2/security/ASA-2007-383.htmhttps://www.redhat.com/archives/fedora-package-announce/2007-October/msg00370.htmlhttp://security.FreeBSD.org/advisories/FreeBSD-SA-07:10.gtar.aschttp://security.gentoo.org/glsa/glsa-200709-09.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:173http://www.novell.com/linux/security/advisories/2007_18_sr.htmlhttp://www.trustix.org/errata/2007/0026/http://www.ubuntu.com/usn/usn-506-1http://www.securitytracker.com/id?1018599http://secunia.com/advisories/26573http://secunia.com/advisories/26590http://secunia.com/advisories/26604http://secunia.com/advisories/26603http://secunia.com/advisories/26674http://secunia.com/advisories/26673http://secunia.com/advisories/26655http://secunia.com/advisories/26781http://secunia.com/advisories/26822http://secunia.com/advisories/26984http://secunia.com/advisories/27453http://secunia.com/advisories/27861http://docs.info.apple.com/article.html?artnum=307179http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlhttp://www.debian.org/security/2007/dsa-1438http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlhttp://secunia.com/advisories/28136http://secunia.com/advisories/28255http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021680.1-1http://www.vupen.com/english/advisories/2007/4238http://www.vupen.com/english/advisories/2007/2958https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7779https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10420http://www.securityfocus.com/archive/1/477865/100/0/threadedhttp://www.securityfocus.com/archive/1/477731/100/0/threadedhttps://usn.ubuntu.com/506-1/https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
man-in-the-middleCVE-2024-34558CVE-2024-32674CVE-2024-34351XPath injectionCVE-2023-45866CVE-2024-25528CVE-2024-25517path traversal
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook