Upstream information
Description
Directory traversal vulnerability in the contains_dot_dot function in src/names.c in GNU tar allows user-assisted remote attackers to overwrite arbitrary files via certain //.. (slash slash dot dot) sequences in directory symlinks in a TAR archive.SUSE information
Overall state of this security issue: Ignore
This issue is currently rated as having moderate severity.
| National Vulnerability Database | |
|---|---|
| Base Score | 6.8 |
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
- SUSE-SR:2007:018, published Fri, 31 Aug 2007 15:00:00 +0000
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE LINUX 10.0 |
| |
| SUSE LINUX 10.1 |
| |
| SUSE LINUX Retail Solution 8 SuSE Linux Desktop 1.0 SuSE Linux Enterprise Server 8 for AMD64 SuSE Linux Enterprise Server 8 for IBM iSeries and IBM pSeries SuSE Linux Enterprise Server 8 for IBM zSeries SuSE Linux Enterprise Server 8 for IPF SuSE Linux Openexchange Server 4 SuSE Linux School Server for i386 SuSE Linux Standard Server 8 UnitedLinux 1.0 |
|
sled10.x86 core9.s390 sles9-oes.x86 slrs8.x86 sles10.s390x ul1.s390 ZYPP Patch Nr: 4125 |
| Novell Linux Desktop 9 for x86 Novell Linux Desktop 9 for x86_64 Open Enterprise Server |
|
sled10.x86 core9.s390 sles9-oes.x86 slrs8.x86 sles10.s390x ul1.s390 ZYPP Patch Nr: 4125 |
| SUSE LINUX 10.0 |
| |
| SUSE LINUX 10.1 |
|
