Vulnerability in tar package allows arbitrary file overwrite
Summary
DLA-690-1: tar - security update. Affects tar versions < 1.26+dfsg-0.1+deb7u1. Fixed in 1.26+dfsg-0.1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tar package is a widely used utility in Debian 7 Wheezy that is responsible for creating and manipulating archive files. It provides functionality to compress and extract files and directories. The vulnerability discovered in this package allows an attacker to overwrite arbitrary files by exploiting crafted files.
Vulnerability Detail
The vulnerability in the tar package allows an attacker to overwrite arbitrary files on the system. By creating specially crafted files, an attacker can manipulate the tar utility to overwrite files with malicious content. This can lead to unauthorized access, data loss, or the execution of arbitrary code. The vulnerability affects the Debian 7 Wheezy version of the tar package.
How To Fix
Minimum fixed version
1.26+dfsg-0.1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the security update to the tar package to mitigate the risk of arbitrary file overwrite.
Conclusion
The vulnerability in the tar package allows an attacker to overwrite arbitrary files on the system. To mitigate this risk, it is recommended to upgrade the tar package to version 1.26+dfsg-0.1+deb7u1 or later. No known workarounds exist for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tar →
FAQ
The vulnerability allows an attacker to overwrite arbitrary files on the system, which can lead to unauthorized access, data loss, or the execution of arbitrary code.
The vulnerability affects version 1.26+dfsg-0.1+deb7u1 and earlier of the tar package in Debian 7 Wheezy.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will alert you if the vulnerability is present.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is important to apply the security update as soon as possible to mitigate the risk.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for tar.
