FLEA-2007-0049-1 tar

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

Foresight Linux Essential Advisory: 2007-0049-1 Published: 2007-08-27

Rating: Severe

Updated Versions:

    tar=/conary.rpath.com@rpl:devel//1/1.15.1-7.2-1     group-dist=/foresight.rpath.org@fl:1-devel//1/1.3.2-0.10-1

References:

    
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1267
    
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0399
    
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4131

Description:

    Previous versions of the tar package are vulnerable to an attack in     which unpacking an intentionally-malformed tar archive can overwrite     arbitrary files to which the user running tar has write access. If the     attacking user knows the name of a vulnerable binary file and overwrites     it, this allows the attacker to place arbitrary code on the system which     is likely to be run. If root is running tar, this includes any file on     the system, which would elevate this to an indirect non-deterministic     remote root unauthorized access vulnerability.

• ---

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Copyright 2007 Foresight Linux Project
This file is distributed under the terms of the MIT License. A copy is available at http://www.foresightlinux.org/permanent/mit-license.html
-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFG0scsWu/kq4lN9jkRAg1QAKCLUKCja3x6mYE2UPg4gx/UhV7HKACfVam/ pqYxERJoh5zq9L/zVehiNw4=
=IbBY
-----END PGP SIGNATURE-----
Received on Mon Aug 27 16:15:30 2007