Support > Knowledge Base

Knowledge Base

Search the Knowledge Base:

Guided Search

Products:

Search In:

Security Response to CVE-2006-6097: Path Traversal Flaw in the Way GNU tar Extracted Archives

Details

VMware Security Response
CVE identifier	CVE-2006-6097
Synopsis	Path traversal flaw in the way GNU tar extracted archives
CVE URL	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6097
Response issued on	December 20, 2006
Response updated on

Relevant Release

ESX Server versions

2.0.2
2.1.3
2.5.3
2.5.4
2.5.5
3.0.0
3.0.1

Problem Description

CVE-2006-6097 reports the following issue:

GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.

Red Hat security advisory RHSA-2006-0749 reports the issue as:

Teemu Salmela discovered a path traversal flaw in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar has write access. (CVE-2006-6097)

Solution

A fix for this issue will be included in upcoming patch releases for ESX Server.

Keywords

alertz; urlz

Feedback

Actions

KB Article: 2240267
Updated: Aug 14, 2009

Products:
VMware ESX
Product Versions:
VMware ESX 2.0.x
VMware ESX 2.1.x
VMware ESX 2.5.x
VMware ESX 3.0.x

Did this article help you?
This article resolved my issue. This article did not resolve my issue. This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (2000 or fewer characters)