Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences.

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2010-373:01 advisory.

    Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for     quick and easy files handling while also allowing for the creation of tar file objects for custom     manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or     gzipped tar files.
    Security issues fixed with this release:
    CVE-2007-4829     Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted     remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an     absolute path or has '..' sequences.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has perl packages installed that are affected by multiple vulnerabilities:

  - Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers     to execute arbitrary code via a large item count. (CVE-2018-6913)

  - Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted     remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an     absolute path or has .. sequences. (CVE-2007-4829)

  - The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing     a chmod, which allows local users to modify the permissions of arbitrary files via a symlink attack, a     different vulnerability than CVE-2005-0448 and CVE-2004-0452. (CVE-2008-2827)

  - Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a     UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression     match. (CVE-2009-3626)

  - The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers     to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers     an uninitialized pointer dereference. (CVE-2011-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2010:0505 :

An updated perl-Archive-Tar package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Archive::Tar module provides a mechanism for Perl scripts to manipulate tar archive files.

Multiple directory traversal flaws were discovered in the Archive::Tar module. A specially crafted tar file could cause a Perl script, using the Archive::Tar module to extract the archive, to overwrite an arbitrary file writable by the user running the script.
(CVE-2007-4829)

This package upgrades the Archive::Tar module to version 1.39_01.
Refer to the Archive::Tar module's changes file, linked to in the References, for a full list of changes.

Users of perl-Archive-Tar are advised to upgrade to this updated package, which corrects these issues. All applications using the Archive::Tar module must be restarted for this update to take effect.

Multiple directory traversal flaws were discovered in the Archive::Tar module. A specially crafted tar file could cause a Perl script, using the Archive::Tar module to extract the archive, to overwrite an arbitrary file writable by the user running the script.
(CVE-2007-4829)

This package upgrades the Archive::Tar module to version 1.39_01.

All applications using the Archive::Tar module must be restarted for this update to take effect.

Note: SL 40-45 needed perl-IO-Zlib

An updated perl-Archive-Tar package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The Archive::Tar module provides a mechanism for Perl scripts to manipulate tar archive files.

Multiple directory traversal flaws were discovered in the Archive::Tar module. A specially crafted tar file could cause a Perl script, using the Archive::Tar module to extract the archive, to overwrite an arbitrary file writable by the user running the script.
(CVE-2007-4829)

This package upgrades the Archive::Tar module to version 1.39_01.
Refer to the Archive::Tar module's changes file, linked to in the References, for a full list of changes.

Users of perl-Archive-Tar are advised to upgrade to this updated package, which corrects these issues. All applications using the Archive::Tar module must be restarted for this update to take effect.

Jonathan Smith discovered that the Archive::Tar Perl module did not correctly handle symlinks when extracting archives. If a user or automated system were tricked into opening a specially crafted tar file, a remote attacker could over-write arbitrary files.
(CVE-2007-4829)

Tavis Ormandy and Will Drewry discovered that Perl did not correctly handle certain utf8 characters in regular expressions. If a user or automated system were tricked into using a specially crafted expression, a remote attacker could crash the application, leading to a denial of service. Ubuntu 8.10 was not affected by this issue.
(CVE-2008-1927)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could create arbitrary setuid binaries. Ubuntu 6.06 and 8.10 were not affected by this issue. (CVE-2008-5302)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could delete arbitrary files. Ubuntu 6.06 was not affected by this issue. (CVE-2008-5303).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-700-1 fixed vulnerabilities in Perl. Due to problems with the Ubuntu 8.04 build, some Perl .ph files were missing from the resulting update. This update fixes the problem. We apologize for the inconvenience.

Jonathan Smith discovered that the Archive::Tar Perl module did not correctly handle symlinks when extracting archives. If a user or automated system were tricked into opening a specially crafted tar file, a remote attacker could over-write arbitrary files.
(CVE-2007-4829)

Tavis Ormandy and Will Drewry discovered that Perl did not correctly handle certain utf8 characters in regular expressions. If a user or automated system were tricked into using a specially crafted expression, a remote attacker could crash the application, leading to a denial of service.
Ubuntu 8.10 was not affected by this issue. (CVE-2008-1927)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could create arbitrary setuid binaries. Ubuntu 6.06 and 8.10 were not affected by this issue. (CVE-2008-5302)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could delete arbitrary files. Ubuntu 6.06 was not affected by this issue.
(CVE-2008-5303).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2007-4829 perl-Archive-Tar directory traversal flaws. Update of Pod::Simple with better html support.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200812-10 (Archive::Tar: Directory traversal vulnerability)

    Jonathan Smith of rPath reported that Archive::Tar does not check for     '..' in file names.
  Impact :

    A remote attacker could entice a user or automated system to extract a     specially crafted tar archive, overwriting files at arbitrary locations     outside of the specified directory.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
284224	MiracleLinux 3 : perl-Archive-Tar-1.39.1-1.AXS3.1 (AXSA:2010-373:01)	Nessus	Miracle Linux Local Security Checks	high
266244	NewStart CGSL MAIN 6.06 : perl Multiple Vulnerabilities (NS-SA-2025-0211)	Nessus	NewStart CGSL Local Security Checks	critical
68057	Oracle Linux 4 / 5 : perl-Archive-Tar (ELSA-2010-0505)	Nessus	Oracle Linux Local Security Checks	medium
60811	Scientific Linux Security Update : perl-Archive-Tar on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
47871	RHEL 4 / 5 : perl-Archive-Tar (RHSA-2010:0505)	Nessus	Red Hat Local Security Checks	medium
47703	CentOS 4 / 5 : perl-Archive-Tar (CESA-2010:0505)	Nessus	CentOS Local Security Checks	medium
37888	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libarchive-tar-perl, perl vulnerabilities (USN-700-1)	Nessus	Ubuntu Local Security Checks	medium
37746	Ubuntu 8.04 LTS : perl regression (USN-700-2)	Nessus	Ubuntu Local Security Checks	medium
36266	Fedora 10 : perl-5.10.0-52.fc10 (2008-11736)	Nessus	Fedora Local Security Checks	medium
35085	GLSA-200812-10 : Archive::Tar: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2007-4829

high

Tenable Plugins

high

critical

medium

medium

medium

medium

medium

medium

medium

medium