oss-sec mailing list archives
Re: CVE Request: BusyBox tar directory traversal
From: Tim Brown <tmb () 65535 com>
Date: Fri, 23 Oct 2015 07:15:53 +0100
On Thursday 22 October 2015 22:40:29 Robert Watson wrote:
Apologies if I'm naive but... since /tmp is world writable, how is this a vulnerability?
The permissions on /tmp having nothing at all to do with this, not sure why you brought that up. With most archiving tools, there is an expectation that unpacking will involve writing only to the current directory and below and/or a user specified directory and below. This breaks that assumption because the unpacker may create a symlink to a location outside of the directory which later may then be followed when further files are unpacked. Depending on the user permissions, this could lead to sensitive files being overwritten. Even if the unpacker validates the path it is writing to is as described, the validation fails to account for the potential presence of symbolic link files that point elsewhere. Tim -- Tim Brown <mailto:tmb () 65535 com>
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- CVE Request: BusyBox tar directory traversal Tyler Hicks (Oct 21)
- Re: CVE Request: BusyBox tar directory traversal Tyler Hicks (Oct 21)
- Re: CVE Request: BusyBox tar directory traversal cve-assign (Oct 21)
- Re: CVE Request: BusyBox tar directory traversal Robert Watson (Oct 22)
- Re: CVE Request: BusyBox tar directory traversal Tim Brown (Oct 22)
- Re: CVE Request: BusyBox tar directory traversal Robert Watson (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Yves-Alexis Perez (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Robert Watson (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Jeremy Stanley (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Jeremy Stanley (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Tim Brown (Oct 22)
- Re: CVE Request: BusyBox tar directory traversal Russ Allbery (Oct 23)