• info
• discussion
• exploit
• solution
• references

GNU Tar Hostile Destination Path Variant Vulnerability

Solution:
Please see the referenced vendor advisories for details on obtaining and applying the appropriate updates.


GNU tar 1.13.25

• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Corporate Server 1.0.1
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Mandrake Linux 7.1
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Mandrake Linux 7.2
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Mandrake Linux 8.0
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Mandrake Linux 8.1
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Mandrake Linux 8.2
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Mandrake Linux 9.0
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.i586.rpm
  Single Network Firewall 7.2
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.ia64.rpm
  Mandrake Linux 8.1/ia64
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.ppc.rpm
  Mandrake Linux 8.0/ppc
  http://www.mandrakesecure.net/en/ftp.php


• MandrakeSoft tar-1.13.25-6.2mdk.ppc.rpm
  Mandrake Linux 8.2/ppc
  http://www.mandrakesecure.net/en/ftp.php


• Red Hat tar-1.13.25-1.6.alpha.rpm
  ftp://updates.redhat.com/6.2/en/os/alpha/tar-1.13.25-1.6.alpha.rpm


• Red Hat tar-1.13.25-1.6.i386.rpm
  ftp://updates.redhat.com/6.2/en/os/i386/tar-1.13.25-1.6.i386.rpm


• Red Hat tar-1.13.25-1.6.sparc.rpm
  ftp://updates.redhat.com/6.2/en/os/sparc/tar-1.13.25-1.6.sparc.rpm


• Red Hat tar-1.13.25-4.7.1.alpha.rpm
  ftp://updates.redhat.com/7.0/en/os/alpha/tar-1.13.25-4.7.1.alpha.rpm


• Red Hat tar-1.13.25-4.7.1.alpha.rpm
  ftp://updates.redhat.com/7.1/en/os/alpha/tar-1.13.25-4.7.1.alpha.rpm


• Red Hat tar-1.13.25-4.7.1.i386.rpm
  ftp://updates.redhat.com/7.0/en/os/i386/tar-1.13.25-4.7.1.i386.rpm


• Red Hat tar-1.13.25-4.7.1.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/tar-1.13.25-4.7.1.i386.rpm


• Red Hat tar-1.13.25-4.7.1.i386.rpm
  ftp://updates.redhat.com/7.2/en/os/i386/tar-1.13.25-4.7.1.i386.rpm


• Red Hat tar-1.13.25-4.7.1.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/tar-1.13.25-4.7.1.i386.rpm


• Red Hat tar-1.13.25-4.7.1.ia64.rpm
  ftp://updates.redhat.com/7.1/en/os/ia64/tar-1.13.25-4.7.1.ia64.rpm


• Red Hat tar-1.13.25-4.7.1.ia64.rpm
  ftp://updates.redhat.com/7.2/en/os/ia64/tar-1.13.25-4.7.1.ia64.rpm


• Sun Qube3-All-Security-4.0.1-16170.pkg
  http://sunsolve.sun.com/patches/cobalt/


• Sun RaQ3-All-Security-5.0.1-16170.pkg
  http://sunsolve.sun.com/patches/cobalt/


• Sun RaQ4-All-Security-2.0.2-16170.pkg
  http://sunsolve.sun.com/patches/cobalt/


• Sun RaQ550-All-Security-0.0.1-16170.pkg
  http://sunsolve.sun.com/patches/cobalt/


• Sun RaQXTR-All-Security-1.0.1-16170.pkg
  http://sunsolve.sun.com/patches/cobalt/


• Sun tar-1.13.25-4.7.1.i386.rpm
  http://sunsolve.sun.com/patches/linux/security.html