sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] [SMGLSA-2006-19] tar: Buffer overflow via unspecified vectors involving PAX extended headers

From: George sherwood <pilot AT beernabeer.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] [SMGLSA-2006-19] tar: Buffer overflow via unspecified vectors involving PAX extended headers
Date: Wed, 12 Apr 2006 16:23:22 -0400

Summary
============

Buffer overflow in tar 1.14 through 1.15.90 allows user-complicit
attackers to cause a denial of service (application crash) and possibly
execute code via unspecified vectors involving PAX extended headers.

Impact
=================
Allows user-complicit attackers to cause a denial of service
(application crash) and possibly execute code via unspecified vectors
involving PAX extended headers.

Solution:
=========
Update tar as soon as possible.

Resolution
==========
All tar users should upgrade to the latest available version:
# scribe update
# cast -c tar

References
============
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0300

Attachment: signature.asc
Description: PGP signature

[SM-Security] [SMGLSA-2006-19] tar: Buffer overflow via unspecified vectors involving PAX extended headers, George sherwood, 04/12/2006