GLSA-200812-10 : Archive::Tar: Directory traversal vulnerability
Medium Nessus Plugin ID 35085
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200812-10 (Archive::Tar: Directory traversal vulnerability)
Jonathan Smith of rPath reported that Archive::Tar does not check for '..' in file names.
A remote attacker could entice a user or automated system to extract a specially crafted tar archive, overwriting files at arbitrary locations outside of the specified directory.
There is no known workaround at this time.
SolutionAll Archive::Tar users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=perl-core/Archive-Tar-1.40'