Re: CVE Request: BusyBox tar directory traversal

[Russ Allbery <eagle () eyrie org>]

Not to beat a dead thread, but no one seems to have given a specific
example.

Robert Watson <robertcwatson1 () gmail com> writes:

> If the user unpacking the tar does not have write access to the target
> directory of the symlink, won't the write of that file fail?

> If the unpacking user *does* have write access to the symlink target
> directory, but the file already exists in that directory, however the
> user does not have write-access to that file, won't the write fail then
> as well?

Imagine that you're unpacking a distribution tarball of some software in
your home directory to take a look at it, and that distribution contained
the file ../../.bashrc.  You don't want it to be able to overwrite your
.bashrc; consider the interesting things that it could do with creative
aliases, such as emailing the contents of any file you cp or rm to some
random email address.

That's an example for an individual user.  If you're unpacking things as
root (more typical for the BusyBox use case), there are much worse things
that one can do, such as overwriting /etc/shadow with known hashes or
replacing /usr/sbin/sshd with a version that has a back door.

That's why tar programs work hard to keep the contents below the directory
into which they were unpacked, and require that you unpack from / (or use
some equivalent, like -C /) if you really want to give the archive
unlimited write access to the file system.

-- 
Russ Allbery (eagle () eyrie org)              <http://www.eyrie.org/~eagle/>