GNU Tar Invalid Headers Buffer Overflow Vulnerability
BID:16764
Info
GNU Tar Invalid Headers Buffer Overflow Vulnerability
| Bugtraq ID: | 16764 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2006-0300 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 22 2006 12:00AM |
| Updated: | Apr 30 2009 03:56PM |
| Credit: | Discovered by Jim Meyering. |
| Vulnerable: |
Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 10.0_x86 Sun Solaris 10.0 Sun OpenSolaris build snv_80 Sun OpenSolaris build snv_68 Sun OpenSolaris build snv_67 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_59 Sun OpenSolaris build snv_39 Sun OpenSolaris build snv_36 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 Redhat Linux 9.0 i386 Redhat Linux 7.3 i386 Redhat Fedora Core3 Redhat Fedora Core2 Redhat Fedora Core1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux AS 4 Redhat Desktop 4.0 OpenPKG OpenPKG 2.5 OpenPKG OpenPKG 2.4 OpenPKG OpenPKG 2.3 OpenPKG OpenPKG Current GNU tar 1.15.90 GNU tar 1.15.1 GNU tar 1.14.90 GNU tar 1.15 GNU tar 1.14 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Avaya S8710 R2.0.1 Avaya S8710 R2.0.0 Avaya S8700 R2.0.1 Avaya S8700 R2.0.0 Avaya S8500 R2.0.1 Avaya S8500 R2.0.0 Avaya S8300 R2.0.1 Avaya S8300 R2.0.0 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 |
| Not Vulnerable: |
Sun OpenSolaris build snv_81 |
Discussion
GNU Tar Invalid Headers Buffer Overflow Vulnerability
GNU Tar is prone to a buffer overflow when handling invalid headers. Successful exploitation could potentially lead to arbitrary code execution, but this has not been confirmed.
Tar 1.14 through 1.15.90 are affected; other versions may also be vulnerable.
GNU Tar is prone to a buffer overflow when handling invalid headers. Successful exploitation could potentially lead to arbitrary code execution, but this has not been confirmed.
Tar 1.14 through 1.15.90 are affected; other versions may also be vulnerable.
Exploit / POC
GNU Tar Invalid Headers Buffer Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
GNU Tar Invalid Headers Buffer Overflow Vulnerability
Solution:
Patches are available from various vendors. Please see the referenced advisories for details.
Sun Solaris 10.0
GNU tar 1.14
Sun Solaris 9
Sun Solaris 9_x86
GNU tar 1.15.1
Apple Mac OS X 10.4
Apple Mac OS X Server 10.4
Apple Mac OS X Server 10.4.1
Apple Mac OS X 10.4.2
Apple Mac OS X Server 10.4.3
Apple Mac OS X 10.4.3
Apple Mac OS X Server 10.4.4
Apple Mac OS X 10.4.4
Apple Mac OS X Server 10.4.5
Apple Mac OS X 10.4.5
Apple Mac OS X Server 10.4.6
Apple Mac OS X Server 10.4.7
Apple Mac OS X 10.4.7
Apple Mac OS X 10.4.8
Apple Mac OS X Server 10.4.8
Apple Mac OS X Server 10.4.9
Apple Mac OS X 10.4.9
Solution:
Patches are available from various vendors. Please see the referenced advisories for details.
Sun Solaris 10.0
GNU tar 1.14
-
Debian tar_1.14-2.1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_alpha. deb -
Debian tar_1.14-2.1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_amd64. deb -
Debian tar_1.14-2.1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_arm.de b -
Debian tar_1.14-2.1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_hppa.d eb -
Debian tar_1.14-2.1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_i386.d eb -
Debian tar_1.14-2.1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_ia64.d eb -
Debian tar_1.14-2.1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_m68k.d eb -
Debian tar_1.14-2.1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_mips.d eb -
Debian tar_1.14-2.1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_mipsel .deb -
Debian tar_1.14-2.1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_powerp c.deb -
Debian tar_1.14-2.1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_s390.d eb -
Debian tar_1.14-2.1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/t/tar/tar_1.14-2.1_sparc. deb -
Fedora Legacy tar-1.14-5.FC3.1.legacy.i386.rpm
Fedora Core 3:
http://download.fedoralegacy.org/fedora/3/updates/i386/tar-1.14-5.FC3. 1.legacy.i386.rpm -
Fedora Legacy tar-1.14-5.FC3.1.legacy.x86_64.rpm
Fedora Core 3:
http://download.fedoralegacy.org/fedora/3/updates/x86_64/tar-1.14-5.FC 3.1.legacy.x86_64.rpm -
Mandriva tar-1.14-1.1.101mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva tar-1.14-1.1.101mdk.x86_64.rpm
Mandriva Linux 10.1/X86_64
http://wwwnew.mandriva.com/en/downloads/ -
Trustix tar-1.14-2tr.i586.rpm
TSL 3.0
ftp://ftp.trustix.org/pub/trustix/updates -
Trustix tar-1.15.1-5tr.i586.rpm
TSL 3.0
ftp://ftp.trustix.org/pub/trustix/updates
Sun Solaris 9
-
Sun 118191-01
http://sunsolve.sun.com/search/document.do?assetkey=1-21-118191-01-1 -
Sun 118191-02
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -118191-02-1
Sun Solaris 9_x86
-
Sun 118192-01
http://sunsolve.sun.com/search/document.do?assetkey=1-21-118191-01-1 -
Sun 118192-02
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -118192-02-1
GNU tar 1.15.1
-
Mandriva tar-1.15.1-2.1.102mdk.i586.rpm
Mandriva Linux 10.2:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva tar-1.15.1-2.1.102mdk.x86_64.rpm
Mandriva Linux 10.2/X86_64:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva tar-1.15.1-5.1.20060mdk.i586.rpm
Mandriva Linux 2006.0:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva tar-1.15.1-5.1.20060mdk.x86_64.rpm
Mandriva Linux 2006.0/X86_64:
http://wwwnew.mandriva.com/en/downloads/ -
OpenPKG tar-1.15.1-2.3.1
OpenPKG 2.3
ftp://ftp.openpkg.org/release -
OpenPKG tar-1.15.1-2.4.1
OpenPKG 2.4
ftp://ftp.openpkg.org/release -
OpenPKG tar-1.15.1-2.5.1
OpenPKG 2.5
ftp://ftp.openpkg.org/release
Apple Mac OS X 10.4
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.1
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.4.2
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.3
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.4.3
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.4
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.4.4
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.5
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.4.5
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.6
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.7
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.4.7
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X 10.4.8
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.8
-
Apple Mac OS X v10.4.9
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.4.9
-
Apple Security Update 2007-004 (Universal)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13659&cat= 1&platform=osx&method=sa/SecUpd2007-004Univ.dmg
Apple Mac OS X 10.4.9
-
Apple Security Update 2007-004 (Universal)
http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=13659&cat= 1&platform=osx&method=sa/SecUpd2007-004Univ.dmg
References
GNU Tar Invalid Headers Buffer Overflow Vulnerability
References:
References:
- ASA-2006-095 - tar security update (RHSA-2006-0232) (Avaya)
- GNU tar Homepage (GNU)
- RHSA-2006:0232-3 - tar security update (Red Hat)
- APPLE-SA-2007-04-19 Security Update 2007-004 (Apple)
- ASA-2008-381 Security Vulnerability in GNU tar May Lead to Arbitrary Code Execut (Avaya)
- Solution 241646: Security Vulnerability in GNU tar May Lead to Arbitrary Code Ex (Sun)