Directory traversal vulnerability in extract.c in star before 1.5a84 allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-0873 advisory.

    [1.5a08-5]
     - fix directory traversal vulnerability CVE-2007-4134
     - Resolves: rhbz#254130

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A path traversal flaw was discovered in the way star extracted archives. A malicious user could create a tar archive that would cause star to write to arbitrary files to which the user running star had write access. (CVE-2007-4134)

As well, this update adds the command line argument '-..' to the Red Hat Enterprise Linux 3 version of star. This allows star to extract files containing '/../' in their pathname.

- Mon Aug 27 2007 Peter Vrabec <pvrabec at redhat.com>     1.5a84-2

    - fix segfault of data-change-warn option (#255261),       patch from dkopecek at redhat.com

  - Fri Aug 24 2007 Peter Vrabec <pvrabec at redhat.com>     1.5a84-1

    - new upstream release with CVE-2007-4134 fix

    - Sun Jun 24 2007 Peter Vrabec <pvrabec at redhat.com>       1.5a76-3

    - build star on ARM platforms (#245465)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-23 (Star: Directory traversal vulnerability)

    Robert Buchholz of the Gentoo Security team discovered a directory     traversal vulnerability in the has_dotdot() function which does not     identify //.. (slash slash dot dot) sequences in file names inside tar     files.
  Impact :

    By enticing a user to extract a specially crafted tar archive, a remote     attacker could extract files to arbitrary locations outside of the     specified directory with the permissions of the user running Star.
  Workaround :

    There is no known workaround at this time.

An updated star package that fixes a path traversal flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Star is a tar-like archiver. It saves multiple files into a single tape or disk archive, and can restore individual files from the archive. Star includes multi-volume support, automatic archive format detection and ACL support.

A path traversal flaw was discovered in the way star extracted archives. A malicious user could create a tar archive that would cause star to write to arbitrary files to which the user running star had write access. (CVE-2007-4134)

Red Hat would like to thank Robert Buchholz for reporting this issue.

As well, this update adds the command line argument '-..' to the Red Hat Enterprise Linux 3 version of star. This allows star to extract files containing '/../' in their pathname.

Users of star should upgrade to this updated package, which contain backported patches to correct these issues.

ID	Name	Product	Family	Severity
67565	Oracle Linux 5 : Moderate: / star (ELSA-2007-0873)	Nessus	Oracle Linux Local Security Checks	high
60249	Scientific Linux Security Update : star on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
27737	Fedora 7 : star-1.5a84-2.fc7 (2007-1852)	Nessus	Fedora Local Security Checks	medium
27555	GLSA-200710-23 : Star: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	medium
25988	RHEL 3 / 4 / 5 : star (RHSA-2007:0873)	Nessus	Red Hat Local Security Checks	medium
25972	CentOS 3 / 4 / 5 : star (CESA-2007:0873)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-4134

high

Tenable Plugins

high

medium

medium

medium

medium

medium