Date: Fri, 23 Oct 2015 03:01:46 -0400 From: Robert Watson <robertcwatson1@...il.com> To: oss-security@...ts.openwall.com Subject: Re: CVE Request: BusyBox tar directory traversal If the user unpacking the tar does not have write access to the target directory of the symlink, won't the write of that file fail? If the unpacking user *does* have write access to the symlink target directory, but the file already exists in that directory, however the user does not have write-access to that file, won't the write fail then as well? A common use-case for tar is writing to a single directory and below as you say. But it is by no means the only capability. Remember that tar was created primarily for software distribution and compressed tar files are most often used to this day for that purpose. Software distribution almost always involves writing files to many different directories at all levels of the filesystem. Symlinks between them are quite common as well. What am I misunderstanding? *Trust in truth keeps hope aliverobertcwatson1@...il.com <robertcwatson1@...il.com>www.docsalvage.info <http://www.docsalvage.info>www.CivicChorale.org <http://www.CivicChorale.org>* <http://www.wunderground.com/cgi-bin/findweather/getForecast?query=Tallahassee,%20FL> <https://www.healthcare.gov/> On Fri, Oct 23, 2015 at 2:15 AM, Tim Brown <tmb@...35.com> wrote: > On Thursday 22 October 2015 22:40:29 Robert Watson wrote: > > Apologies if I'm naive but... since /tmp is world writable, how is this a > > vulnerability? > > The permissions on /tmp having nothing at all to do with this, not sure why > you brought that up. With most archiving tools, there is an expectation > that > unpacking will involve writing only to the current directory and below > and/or > a user specified directory and below. This breaks that assumption because > the > unpacker may create a symlink to a location outside of the directory which > later may then be followed when further files are unpacked. Depending on > the > user permissions, this could lead to sensitive files being overwritten. > Even if > the unpacker validates the path it is writing to is as described, the > validation fails to account for the potential presence of symbolic link > files > that point elsewhere. > > Tim > -- > Tim Brown > <mailto:tmb@...35.com>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.