CVE-2007-4131

Published: Aug 25, 2007Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

Affected (16)

Products: Gnu: Tar

Gnu

1 product

Tar

Configuration A

16 vulnerable · 7 platform

Vulnerable Software	Affected Versions
Gnu Tar	Version 1.13.11
Gnu Tar	Version 1.13.14
Gnu Tar	Version 1.13.16
Gnu Tar	Version 1.13.17
Gnu Tar	Version 1.13.18
Gnu Tar	Version 1.13.19
Gnu Tar	Version 1.13.25
Gnu Tar	Version 1.13.5
Gnu Tar	Version 1.13
Gnu Tar	Version 1.14.90
Gnu Tar	Version 1.14
Gnu Tar	Version 1.15.1
Gnu Tar	Version 1.15.90
Gnu Tar	Version 1.15.91
Gnu Tar	Version 1.15
Gnu Tar	Version 1.16

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux	Version 4.0
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux Desktop	Version 5.0
Rpath Rpath Linux	Version 1

References (76)

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=251921

Source: secalert@redhat.com

http://docs.info.apple.com/article.html?artnum=307179

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html

Source: secalert@redhat.com

http://secunia.com/advisories/26573

Source: secalert@redhat.com

http://secunia.com/advisories/26590

Source: secalert@redhat.com

http://secunia.com/advisories/26603

Source: secalert@redhat.com

http://secunia.com/advisories/26604

Source: secalert@redhat.com

http://secunia.com/advisories/26655

Source: secalert@redhat.com

http://secunia.com/advisories/26673

Source: secalert@redhat.com

http://secunia.com/advisories/26674

Source: secalert@redhat.com

http://secunia.com/advisories/26781

Source: secalert@redhat.com

http://secunia.com/advisories/26822

Source: secalert@redhat.com

http://secunia.com/advisories/26984

Source: secalert@redhat.com

http://secunia.com/advisories/27453

Source: secalert@redhat.com

http://secunia.com/advisories/27861

Source: secalert@redhat.com

http://secunia.com/advisories/28136

Source: secalert@redhat.com

http://secunia.com/advisories/28255

Source: secalert@redhat.com

http://security.FreeBSD.org/advisories/FreeBSD-SA-07:10.gtar.asc

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200709-09.xml

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021680.1-1

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2007-383.htm

Source: secalert@redhat.com

http://www.debian.org/security/2007/dsa-1438

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2007:173

Source: secalert@redhat.com

http://www.novell.com/linux/security/advisories/2007_18_sr.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0860.html

Source: secalert@redhat.com

Patch

http://www.securityfocus.com/archive/1/477731/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/477865/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/25417

Source: secalert@redhat.com

http://www.securitytracker.com/id?1018599

Source: secalert@redhat.com

http://www.trustix.org/errata/2007/0026/

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-506-1

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA07-352A.html

Source: secalert@redhat.com

US Government Resource

http://www.vupen.com/english/advisories/2007/2958

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/4238

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1631

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10420

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7779

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00370.html

Source: secalert@redhat.com

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=251921