Date: Fri, 23 Oct 2015 15:15:03 -0700 From: Russ Allbery <eagle@...ie.org> To: Robert Watson <robertcwatson1@...il.com> Cc: oss-security@...ts.openwall.com Subject: Re: CVE Request: BusyBox tar directory traversal Not to beat a dead thread, but no one seems to have given a specific example. Robert Watson <robertcwatson1@...il.com> writes: > If the user unpacking the tar does not have write access to the target > directory of the symlink, won't the write of that file fail? > If the unpacking user *does* have write access to the symlink target > directory, but the file already exists in that directory, however the > user does not have write-access to that file, won't the write fail then > as well? Imagine that you're unpacking a distribution tarball of some software in your home directory to take a look at it, and that distribution contained the file ../../.bashrc. You don't want it to be able to overwrite your .bashrc; consider the interesting things that it could do with creative aliases, such as emailing the contents of any file you cp or rm to some random email address. That's an example for an individual user. If you're unpacking things as root (more typical for the BusyBox use case), there are much worse things that one can do, such as overwriting /etc/shadow with known hashes or replacing /usr/sbin/sshd with a version that has a back door. That's why tar programs work hard to keep the contents below the directory into which they were unpacked, and require that you unpack from / (or use some equivalent, like -C /) if you really want to give the archive unlimited write access to the file system. -- Russ Allbery (eagle@...ie.org) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.