Date: Wed, 21 Oct 2015 10:36:33 -0500 From: Tyler Hicks <tyhicks@...onical.com> To: oss-security@...ts.openwall.com Cc: security@...ntu.com, Denys Vlasenko <vda.linux@...glemail.com> Subject: CVE Request: BusyBox tar directory traversal Hello - The BusyBox implementation of tar will extract a symlink that points outside of the current working directory and then follow that symlink when extracting other files. This allows for a directory traversal attack when extracting untrusted tarballs. This behavior was documented in the BusyBox source with the following 2011 commit: http://git.busybox.net/busybox/commit/?id=a116552869db5e7793ae10968eb3c962c69b3d8c I've created an upstream bug report: https://bugs.busybox.net/8411 Can we get a CVE assigned to track this? Thanks! Tyler Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ