SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=13957


m.spitzbarth AT gmx.de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |m.spitzbarth AT gmx.de
            Summary|tar needs a security update |tar (star) needs a security
                   |                            |update




------- Additional Comments From m.spitzbarth AT gmx.de  2007-08-28 05:06 -------
I've taken a look at the bug and I am a bit confused.
My opinion is that this bug is invalid for tar, but valid for star.

The redhat bug is boring, as it is just a link to the gentoo bug
https://bugzilla.redhat.com/show_bug.cgi?id=253856
https://bugs.gentoo.org/show_bug.cgi?id=189690

Both bug reports include the same upstream patch which I have been unable to
find at upstream tar and star (the bug search at berlios is somewhat not my 
type).

The gentoo bug includes a sample tar archive that shows the vulnerability. I
have been unable to reproduce this bug with tar, but maybe some someone else 
can:

ghost@zaphod:/tmp/tar$ tar -xf v.tar
tar: Removing leading `star//..//..' from member names
tar: star: time stamp 2020-12-24 16:15:00 is 420530493.388496599 s in the 
future
tar: Removing leading `star//..//../' from member names
tar: .: time stamp 2020-12-24 16:15:00 is 420530493.388368054 s in the future
tar: README: time stamp 2020-12-24 16:15:00 is 420530493.388293777 s in the 
future
ghost@zaphod:/tmp/tar$ ls -lh
total 20K
-rw-r--r-- 1 ghost users    5 2020-12-24 16:15 README
drwxr-xr-x 2 ghost users 4.0K 2020-12-24 16:15 star
-rw-r--r-- 1 ghost users  10K 2007-08-28 11:11 v.tar

I've found no modifications outside the current working directory. Trying to
apply the given patch to the tar sources failed and I could not find any 
matches
by looking at it by hand.

That's the part concerning tar, now I'll move on to the star part.

First of all, extracting the demo tar archive from the gentoo bug with star 
has
indeed created the file ../README (!).
Applying the patch works fine.
Looking at a diff between star-1.5a83 and the newly released star-1.5a84 shows
that the mentioned patch is already included in it.

After a version update to star-1.5a83, the ../README did not get extracted (it
got extracted by tar from the tar spell, but not to ../README but to plain
./README):

root@zaphod:/tmp/tar# /opt/schily/bin/tar -xf v.tar 
/opt/schily/bin/tar: 'star//..//../' contains '..', skipping ...
/opt/schily/bin/tar: 'star//..//../README' contains '..', skipping ...
/opt/schily/bin/tar: 1 blocks + 0 bytes (total of 10240 bytes = 10.00k).
/opt/schily/bin/tar: The following problems occurred during archive 
processing:
/opt/schily/bin/tar: Cannot: stat 0, open 0, read/write 0. Size changed 0.
/opt/schily/bin/tar: Missing links 0, Name too long 0, File too big 0, Not 
dumped 0.
/opt/schily/bin/tar: Skipped for security reason: path name 2, link name 0.
/opt/schily/bin/tar: Processed all possible files, despite earlier errors.
root@zaphod:/tmp/tar# ls -lh  
total 16K
drwxr-xr-x 2 ghost smgl  4.0K 2020-12-24 16:15 star
-rw-r--r-- 1 ghost users  10K 2007-08-28 11:11 v.tar

I have updated star in commit c2bde5d40b7c3920d723ea21807470eac9aa249f

Can someone peer-review this before I mark it fixed and request integration to
stable?

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.