Ubuntu 16.10: USN-3132-1 Major Vulnerability in Tar File Overwrite

ubuntu

November 21, 2016

tar could be made to overwrite files.

Summary

tar could be made to overwrite files.

Software Description:

- tar: GNU version of the tar archiving utility

Details:

Harry Sintonen discovered that tar incorrectly handled extracting files

when path names are specified on the command line. If a user or automated

system were tricked into processing a specially crafted archive, an

attacker could possibly overwrite arbitrary files.

Topics Covered

security advisory security issue critical access control file overwrite Ubuntu tar

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  tar                             1.29b-1ubuntu0.1

Ubuntu 16.04 LTS:
  tar                             1.28-2.1ubuntu0.1

Ubuntu 14.04 LTS:
  tar                             1.27.1-1ubuntu0.1

Ubuntu 12.04 LTS:
  tar                             1.26-4ubuntu1.1

In general, a standard system update will make all the necessary changes.