[ GLSA 200812-10 ] Archive::Tar: Directory traversal vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: Archive::Tar: Directory traversal vulnerability (GLSA 200812-10)
Severity: normal
Exploitable: remote
Date: December 10, 2008
Bug(s): #192989
ID: 200812-10

Synopsis


A directory traversal vulnerability has been discovered in Archive::Tar.


Background


Archive::Tar is a Perl module for creation and manipulation of tar
files.


Affected Packages

Package: perl-core/Archive-Tar
Vulnerable: < 1.40
Unaffected: >= 1.40
Architectures: All supported architectures


Description


Jonathan Smith of rPath reported that Archive::Tar does not check for
".." in file names.


Impact


A remote attacker could entice a user or automated system to extract a
specially crafted tar archive, overwriting files at arbitrary locations
outside of the specified directory.


Workaround


There is no known workaround at this time.


Resolution


All Archive::Tar users should upgrade to the latest version: