USN-506-1: tar vulnerability

Releases

• Ubuntu 7.04
• Ubuntu 6.10
• Ubuntu 6.06

Packages

• tar -

Details

Dmitry V. Levin discovered that tar did not correctly detect the ".."
file path element when unpacking archives. If a user or an automated
system were tricked into unpacking a specially crafted tar file, arbitrary
files could be overwritten with user privileges.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 7.04

• tar - 1.16-2ubuntu0.1

Ubuntu 6.10

• tar - 1.15.91-2ubuntu0.4

Ubuntu 6.06

• tar - 1.15.1-2ubuntu2.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2007-4131