OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2006.038
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2006.038
Advisory Published:      2009-01-07 08:45 UTC

Issue Id (internal):     OpenPKG-SI-20061127.01
Issue First Created:     2006-11-27
Issue Last Modified:     2006-12-10
Issue Revision:          08


Subject Name:            GNU tar
Subject Summary:         archive format utility
Subject Home:            http://www.gnu.org/software/tar/
Subject Versions:        * <= 1.16

Vulnerability Id:        CVE-2006-6097, CVE-2002-1216
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           manipulation of data

Description:
    The archive format utility GNU tar [0], versions up to and including
    1.16, allows user-assisted attackers to overwrite arbitrary files
    via a TAR format file that contains a "GNUTYPE_NAMES" record with
    a symbolic link. As the "GNUTYPE_NAMES" based "name mangling"
    functionality in TAR format files is (1) a GNU extension only, (2)
    is no longer supported for TAR file creation by GNU tar since a
    longer time and (3) the extraction of such records is too dangerous,
    the functionality has been deactivated by default now in OpenPKG.
    For backward compatibility (usually to extract already existing
    older TAR format files), the introduced command-line option
    "--allow-name-mangling" is available.

References:
    [0] http://www.gnu.org/software/tar/


Primary Package Name:    tar
Primary Package Home:    http://openpkg.org/go/package/tar

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Enterprise       E1.0-SOLID        openpkg-E1.0.0-E1.0.0
OpenPKG Enterprise       E1.0-SOLID        tar-1.16-E1.0.0
OpenPKG Community        2-STABLE-20061018 openpkg-2.20061030-2.20061030
OpenPKG Community        2-STABLE-20061018 tar-1.16-2.20061018
OpenPKG Community        2-STABLE          openpkg-2.20061207-2.20061207
OpenPKG Community        2-STABLE          tar-1.16-2.20061022
OpenPKG Community        CURRENT           openpkg-20061208-20061208
OpenPKG Community        CURRENT           tar-1.16-20061205

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Enterprise       E1.0-SOLID        openpkg-E1.0.1-E1.0.1
OpenPKG Enterprise       E1.0-SOLID        tar-1.16-E1.0.1
OpenPKG Community        2-STABLE-20061018 openpkg-2.20061210-2.20061210
OpenPKG Community        2-STABLE-20061018 tar-1.16.1-2.20061210
OpenPKG Community        2-STABLE          openpkg-2.20061210-2.20061210
OpenPKG Community        2-STABLE          tar-1.16.1-2.20061210
OpenPKG Community        CURRENT           openpkg-20061010-20061210
OpenPKG Community        CURRENT           tar-1.16.1-20061210