bugtraq - FLEA-2007-0051-1 star

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 06 Sep 2007 18:13:49 -0800
From: Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>
To: foresight-security-announce@...ts.rpath.org
Cc: security-alerts@...uxsecurity.com,
	full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	lwn@....net
Subject: FLEA-2007-0051-1 star

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Foresight Linux Essential Advisory: 2007-0051-1
Published: 2007-09-06

Rating: Severe

Updated Versions:
    star=/conary.rpath.com@rpl:devel//1/1.5a60-4.3-1
    group-dist=/foresight.rpath.org@fl:1-devel//1/1.3.2-0.17-1

References:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4134
    https://issues.rpath.com/browse/RPL-1631
    https://issues.rpath.com/browse/RPL-1669

Description:
    Previous versions of star, an archival program, are vulnerable to an
    attack in which unpacking an intentionally-malformed tar archive can
    overwrite arbitrary files to which the user running tar has write access.
    If unpacked by a superuser, this can lead to arbitrary code execution at
    root permission levels.

- ---

Copyright 2007 Foresight Linux Project
This file is distributed under the terms of the MIT License.
A copy is available at http://www.foresightlinux.org/permanent/mit-license.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (GNU/Linux)

iQIVAwUBRuCz1NfwEn07iAtZAQI7mRAAhIkKbD3WYxgDhfrJd77Xp10B/WGEhTyl
+Yi7tNvWgVYgtpclEqdirkdNChi99/zxWl/MzAbzyZ1Or8izGEhllq6V/p4pEw8m
r2QmLtweljmdpcu1sSUBXZfsPwOqPIxK4IyXZC6+z5z7tWBGK9m3VPHKPiBN/BTS
m2xy+Udia0H3hILNWHsDYxV6fdeUzYCiBmrgw0+fM5zrkqodM9eHACQZaDS9mbh9
Fgo9XtxsXLoscEEyDyp4HPe1P9ENCaxqFG1AW6EEdvWv1i3F2qazp8CDzoKEfGTC
DM0K+in+j5CHWvHVfiZcEdQTB+j3Rkor+XLi5MBiZ0ivbrowcBo7KbNtHpUNiqlg
QsLvPRkRUoIIgfcp/ythmUWW2CaaOTZEs30hHZRVI1vf5MIjfKcePQu5XQssNty5
bp/9jKdby3NTe2fkw1vtQqU/2us+cRhxjTQHGs+otpduO7iwQtlWd51ouVdq8a/Q
RKrJk2OqQAG1YIXslTSWkQPpZzFMG3YXvb5CYg/jQnVW/VjLKyFIU5Tbn6+iZvFI
iLJ7WDm3jY3gSvHVecj8Sltl/BxCPf4EHypkQKzE+khvPVkuNVCmnDOexQ8QzH/r
P4W9amhDwuC9PIoSeR7GDbPcziBBFXA2a6JenWL0pp7QUbxZoY8CfeX05s9iGSPu
x+kduCNICvg=
=cMlR
-----END PGP SIGNATURE-----