full-disclosure - [FD] [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321)

Open Source and information security mailing list archives

Message-ID: <alpine.DEB.2.11.1610300349100.4373@o7.fi>
Date: Sun, 30 Oct 2016 03:03:07 +0200 (EET)
From: Harry Sintonen <fulldisclosure@...er.fi>
To: Harry Sintonen <fulldisclosure@...er.fi>
Cc: fulldisclosure@...lists.org
Subject: [FD] [CSS] POINTYFEATHER / tar extract pathname bypass
 (CVE-2016-6321) - patch update

Update on the advisory: As pointed out by several people, the ERROR
macro did't fail the operation in a desired way: Files were still
being created by tar. In order to really stop tar from doing silly
things, FATAL_ERROR macro needs to be used instead.

The patch has now been updated accordingly.

Updated Advisory: 
https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt

Updated Patch:
https://sintonen.fi/advisories/tar-extract-pathname-bypass.patch

NOTE: Ideas on how to make tar safely skip such entries instead of
failing the whole operating are welcome.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives