libtar <= 1.2.19 Integer overflow

2013-10-10 / 2013-10-20
Risk: Medium
Local: Yes
Remote: No
CWE: CWE-189


Ogólna skala CVSS: 6.8/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

Forwarding information from the linux-distros list to oss-sec, since the issue is public now Details: An integer overflow vulnerability was identified in libtar 1.2.19 (and olders) that can possibly be exploited for arbitrary code execution when extracting a specially crafted tar file. A coordinated release date (CRD) of October 9th has been agreed with Chris Frey (libtar developer). This issue is assigned CVE-2013-4397. This issue is fixed in libtar-1.2.20 Reference: Upstream patch: http://repo.or.cz/w/libtar.git/commit/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04 Announcement: This is an announcement about the release on libtar list, but strangely i cant access the list archives. (i am subscribed to the mailing list though) Red Hat bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1014492

Referencje:

https://bugzilla.redhat.com/show_bug.cgi?id=1014492
http://repo.or.cz/w/libtar.git/commit/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04
http://seclists.org/oss-sec/2013/q4/52


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top