Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 510
Alerts This Week
Warning Icon 1 510

Slackware: SSA:2006-335-01 Critical: Tar File Extraction Risk

slackware
Calendar Grey December 1, 2006
Scroller Slackware
Updated tar distributions for various Slackware versions address key vulnerabilities associated with file unpacking. Discover further details today.
New tar packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix a security issue

Summary

Here are the details from the Slackware 11.0 ChangeLog: patches/packages/tar-1.16-i486-1_slack11.0.tgz: Upgraded to tar-1.16. This fixes an issue where files may be extracted outside of the current directory, possibly allowing a malicious tar archive, when extracted, to overwrite any of the user's files (in the case of root, any file on the system). For more information, see: https://www.cve.org/CVERecord?id=CVE-2006-6097 (* Security fix *)

Topics%20covered

Topics Covered

security advisory security update critical vulnerability Slackware tar package file extraction

Where Find New Packages

HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading from ftp.slackware.com.
Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 8.1: ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/tar-1.16-i386-1_slack8.1.tgz
Updated package for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/tar-1.16-i386-1_slack9.0.tgz
Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/tar-1.16-i486-1_slack9.1.tgz
Updated package for Slackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/tar-1.16-i486-1_slack10...

Read the Full Advisory

MD5 Signatures

Slackware 8.1 package: 7c9534ea20e4dea9481d2e5389ccb028 tar-1.16-i386-1_slack8.1.tgz
Slackware 9.0 package: 876549ce9871fe255e53f6941d652955 tar-1.16-i386-1_slack9.0.tgz
Slackware 9.1 package: c1de51bb69fbecd26c9b7ee317b92fa7 tar-1.16-i486-1_slack9.1.tgz
Slackware 10.0 package: 75e329799b7bf0d536fab1debea5c301 tar-1.16-i486-1_slack10.0.tgz
Slackware 10.1 package: 7a97719499b08cefb77fb0aaee4e2a80 tar-1.16-i486-1_slack10.1.tgz
Slackware 10.2 package: c64be78f5930f9e9557f5ec8b783b7ec tar-1.16-i486-1_slack10.2.tgz
Slackware 11.0 package: 9832de4337bd8e1bd6e43c18e06885dc tar-1.16-i486-1_slack11.0.tgz

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory security update critical vulnerability Slackware tar package file extraction

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the packages as root: # upgradepkg tar-1.16-i486-1_slack11.0.tgz