Skip to Content.
Sympa Menu

sm-grimoire-bugs - [SM-Grimoire-Bugs] [Bug 13957] tar (star) needs a security update

sm-grimoire-bugs AT lists.ibiblio.org

Subject: SourceMage Grimoire Bug List

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-grimoire-bugs AT lists.ibiblio.org
  • Subject: [SM-Grimoire-Bugs] [Bug 13957] tar (star) needs a security update
  • Date: 28 Aug 2007 10:06:24 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=13957


m.spitzbarth AT gmx.de changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |m.spitzbarth AT gmx.de
Summary|tar needs a security update |tar (star) needs a security
| |update




------- Additional Comments From m.spitzbarth AT gmx.de 2007-08-28 05:06 -------
I've taken a look at the bug and I am a bit confused.
My opinion is that this bug is invalid for tar, but valid for star.

The redhat bug is boring, as it is just a link to the gentoo bug
https://bugzilla.redhat.com/show_bug.cgi?id=253856
https://bugs.gentoo.org/show_bug.cgi?id=189690

Both bug reports include the same upstream patch which I have been unable to
find at upstream tar and star (the bug search at berlios is somewhat not my
type).

The gentoo bug includes a sample tar archive that shows the vulnerability. I
have been unable to reproduce this bug with tar, but maybe some someone else
can:

ghost@zaphod:/tmp/tar$ tar -xf v.tar
tar: Removing leading `star//..//..' from member names
tar: star: time stamp 2020-12-24 16:15:00 is 420530493.388496599 s in the
future
tar: Removing leading `star//..//../' from member names
tar: .: time stamp 2020-12-24 16:15:00 is 420530493.388368054 s in the future
tar: README: time stamp 2020-12-24 16:15:00 is 420530493.388293777 s in the
future
ghost@zaphod:/tmp/tar$ ls -lh
total 20K
-rw-r--r-- 1 ghost users 5 2020-12-24 16:15 README
drwxr-xr-x 2 ghost users 4.0K 2020-12-24 16:15 star
-rw-r--r-- 1 ghost users 10K 2007-08-28 11:11 v.tar

I've found no modifications outside the current working directory. Trying to
apply the given patch to the tar sources failed and I could not find any
matches
by looking at it by hand.

That's the part concerning tar, now I'll move on to the star part.

First of all, extracting the demo tar archive from the gentoo bug with star
has
indeed created the file ../README (!).
Applying the patch works fine.
Looking at a diff between star-1.5a83 and the newly released star-1.5a84 shows
that the mentioned patch is already included in it.

After a version update to star-1.5a83, the ../README did not get extracted (it
got extracted by tar from the tar spell, but not to ../README but to plain
./README):

root@zaphod:/tmp/tar# /opt/schily/bin/tar -xf v.tar
/opt/schily/bin/tar: 'star//..//../' contains '..', skipping ...
/opt/schily/bin/tar: 'star//..//../README' contains '..', skipping ...
/opt/schily/bin/tar: 1 blocks + 0 bytes (total of 10240 bytes = 10.00k).
/opt/schily/bin/tar: The following problems occurred during archive
processing:
/opt/schily/bin/tar: Cannot: stat 0, open 0, read/write 0. Size changed 0.
/opt/schily/bin/tar: Missing links 0, Name too long 0, File too big 0, Not
dumped 0.
/opt/schily/bin/tar: Skipped for security reason: path name 2, link name 0.
/opt/schily/bin/tar: Processed all possible files, despite earlier errors.
root@zaphod:/tmp/tar# ls -lh
total 16K
drwxr-xr-x 2 ghost smgl 4.0K 2020-12-24 16:15 star
-rw-r--r-- 1 ghost users 10K 2007-08-28 11:11 v.tar

I have updated star in commit c2bde5d40b7c3920d723ea21807470eac9aa249f

Can someone peer-review this before I mark it fixed and request integration to
stable?

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page