PHP PEAR::Archive_Tar Remote Directory Traversal Vulnerability

Bugtraq ID:	16805
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 24 2006 12:00AM
Updated:	Feb 27 2006 03:51PM
Credit:	Hamid Ebadi is credited with the discovery of this vulnerability.
Vulnerable:	PEAR PEAR::Archive_Zip 1.1 PEAR PEAR::Archive_Tar 1.2
Not Vulnerable:

PHP PEAR::Archive_Tar Remote Directory Traversal Vulnerability

Reportedly, an attacker can carry out directory traversal type attacks. These issues present themselves when the application processes malformed archives.

A successful attack can allow the attacker to place potentially malicious files and overwrite files on a computer in the context of the user running the affected application. Successful exploitation may aid in further attacks.

PHP PEAR::Archive_Tar Remote Directory Traversal Vulnerability

This issue can be exploited by creating a malicious archive file that includes files with directory traversal strings '../' in the names.

PHP PEAR::Archive_Tar Remote Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHP PEAR::Archive_Tar Remote Directory Traversal Vulnerability

References:

• Archive_Tar (Tar file management class) Directory traversal (Tested on 1.2) (Hamid)
  
• Archive_Zip (Zip file management class) Directory traversal (Hamid)
  
• Directory traversal vulnerabilities in .zip .tar .rar (Hamid)
  
• Package Information: Archive_Tar (PEAR)
  
• Archive_Tar v 1.2(Tested) (Tar file management class) Directory traversal (Hamid)