Knowledge Base

Search the Knowledge Base:
Products:
Search In:
 

Security Response to CVE-2006-6097: Path Traversal Flaw in the Way GNU tar Extracted Archives

Details

 

VMware Security Response

CVE identifier

CVE-2006-6097

Synopsis

Path traversal flaw in the way GNU tar extracted archives

CVE URL

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6097

Response issued on

December 20, 2006

Response updated on

 

Relevant Release

ESX Server versions
  • 2.0.2
  • 2.1.3
  • 2.5.3
  • 2.5.4
  • 2.5.5
  • 3.0.0
  • 3.0.1
Problem Description
 
CVE-2006-6097 reports the following issue:
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.
Red Hat security advisory RHSA-2006-0749 reports the issue as:
Teemu Salmela discovered a path traversal flaw in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar has write access. (CVE-2006-6097)

Solution

A fix for this issue will be included in upcoming patch releases for ESX Server.

Keywords

alertz; urlz

Feedback

Rating: 1 - Lowest 2 3 4 5 - Highest (0 Ratings)   

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (2000 or fewer characters)
Submit
Rating: 1 - Lowest 2 3 4 5 - Highest (0 Ratings)   
Actions
  • KB Article: 2240267
  • Updated: Aug 14, 2009
  • Products:
    VMware ESX
  • Product Versions:
    VMware ESX 2.0.x
    VMware ESX 2.1.x
    VMware ESX 2.5.x
    VMware ESX 3.0.x