[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 23 Oct 2015 15:15:03 -0700
From: Russ Allbery <eagle@...ie.org>
To: Robert Watson <robertcwatson1@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request: BusyBox tar directory traversal
Not to beat a dead thread, but no one seems to have given a specific
example.
Robert Watson <robertcwatson1@...il.com> writes:
> If the user unpacking the tar does not have write access to the target
> directory of the symlink, won't the write of that file fail?
> If the unpacking user *does* have write access to the symlink target
> directory, but the file already exists in that directory, however the
> user does not have write-access to that file, won't the write fail then
> as well?
Imagine that you're unpacking a distribution tarball of some software in
your home directory to take a look at it, and that distribution contained
the file ../../.bashrc. You don't want it to be able to overwrite your
.bashrc; consider the interesting things that it could do with creative
aliases, such as emailing the contents of any file you cp or rm to some
random email address.
That's an example for an individual user. If you're unpacking things as
root (more typical for the BusyBox use case), there are much worse things
that one can do, such as overwriting /etc/shadow with known hashes or
replacing /usr/sbin/sshd with a version that has a back door.
That's why tar programs work hard to keep the contents below the directory
into which they were unpacked, and require that you unpack from / (or use
some equivalent, like -C /) if you really want to give the archive
unlimited write access to the file system.
--
Russ Allbery (eagle@...ie.org) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
