CVE-2016-6321
Summary
| CVE | CVE-2016-6321 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2016-12-09 22:59:00 UTC |
|---|
| Updated | 2023-02-13 04:50:00 UTC |
|---|
| Description | Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Gnu |
Tar |
1.14 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15.1 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15.90 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15.91 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.16 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.16.1 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.17 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.18 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.19 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.20 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.21 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.22 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.23 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.24 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.25 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.26 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.27 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.27.1 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.28 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.29 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.14 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15.1 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15.90 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.15.91 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.16 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.16.1 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.17 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.18 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.19 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.20 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.21 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.22 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.23 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.24 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.25 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.26 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.27 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.27.1 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.28 |
All |
All |
All |
| Application |
Gnu |
Tar |
1.29 |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Re: [Bug-tar] possible fixes for CVE-2016-6321 |
MLIST |
lists.gnu.org |
Mailing List, Vendor Advisory |
| Tar: Extract pathname bypass (GLSA 201611-19) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| GNU Tar CVE-2016-6321 Security Bypass Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| Pony Mail! |
MLIST |
lists.apache.org |
|
| GNU tar 1.29 Extract Pathname Bypass ≈ Packet Storm |
MISC |
packetstormsecurity.com |
Exploit, Third Party Advisory, VDB Entry |
| lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e69... |
MISC |
lists.apache.org |
|
| lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450... |
MISC |
lists.apache.org |
|
| Full Disclosure: [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) |
FULLDISC |
seclists.org |
Mailing List, Third Party Advisory |
| Full Disclosure: [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) - patch update |
FULLDISC |
seclists.org |
Mailing List, Patch, Third Party Advisory |
| Pony Mail! |
MLIST |
lists.apache.org |
|
| tar.git - GNU Tar |
CONFIRM |
git.savannah.gnu.org |
Issue Tracking, Patch |
| USN-3132-1: tar vulnerability | Ubuntu |
UBUNTU |
www.ubuntu.com |
|
| sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt |
MISC |
sintonen.fi |
Third Party Advisory |
| Debian -- Security Information -- DSA-3702-1 tar |
DEBIAN |
www.debian.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500681 Alpine Linux Security Update for tar
- 504450 Alpine Linux Security Update for tar
