CVE-2006-0931

Published: Feb 28, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.

Affected (3)

Products: Pear: Pear Archive Tar

Pear

1 product

Pear Archive Tar

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Pear Pear Archive Tar	Up to 1.2
Pear Pear Archive Tar	Up to 1.3.0
Pear Pear Archive Tar	Up to 1.3.1

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (16)

http://pear.php.net/bugs/bug.php?id=6933

Source: cve@mitre.org

http://pear.php.net/package/Archive_Tar/download/

Source: cve@mitre.org

http://secunia.com/advisories/19011

Source: cve@mitre.org

Vendor Advisory

http://www.hamid.ir/security/phptar.txt

Source: cve@mitre.org

Vendor Advisory

http://www.osvdb.org/23481

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/425967/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/16805

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/0728

Source: cve@mitre.org

http://pear.php.net/bugs/bug.php?id=6933