oss-sec mailing list archives
Re: CVE Request: BusyBox tar directory traversal
From: Russ Allbery <eagle () eyrie org>
Date: Fri, 23 Oct 2015 15:15:03 -0700
Not to beat a dead thread, but no one seems to have given a specific example. Robert Watson <robertcwatson1 () gmail com> writes:
If the user unpacking the tar does not have write access to the target directory of the symlink, won't the write of that file fail?
If the unpacking user *does* have write access to the symlink target directory, but the file already exists in that directory, however the user does not have write-access to that file, won't the write fail then as well?
Imagine that you're unpacking a distribution tarball of some software in your home directory to take a look at it, and that distribution contained the file ../../.bashrc. You don't want it to be able to overwrite your .bashrc; consider the interesting things that it could do with creative aliases, such as emailing the contents of any file you cp or rm to some random email address. That's an example for an individual user. If you're unpacking things as root (more typical for the BusyBox use case), there are much worse things that one can do, such as overwriting /etc/shadow with known hashes or replacing /usr/sbin/sshd with a version that has a back door. That's why tar programs work hard to keep the contents below the directory into which they were unpacked, and require that you unpack from / (or use some equivalent, like -C /) if you really want to give the archive unlimited write access to the file system. -- Russ Allbery (eagle () eyrie org) <http://www.eyrie.org/~eagle/>
Current thread:
- CVE Request: BusyBox tar directory traversal Tyler Hicks (Oct 21)
- Re: CVE Request: BusyBox tar directory traversal Tyler Hicks (Oct 21)
- Re: CVE Request: BusyBox tar directory traversal cve-assign (Oct 21)
- Re: CVE Request: BusyBox tar directory traversal Robert Watson (Oct 22)
- Re: CVE Request: BusyBox tar directory traversal Tim Brown (Oct 22)
- Re: CVE Request: BusyBox tar directory traversal Robert Watson (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Yves-Alexis Perez (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Robert Watson (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Jeremy Stanley (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Jeremy Stanley (Oct 23)
- Re: CVE Request: BusyBox tar directory traversal Tim Brown (Oct 22)
- Re: CVE Request: BusyBox tar directory traversal Russ Allbery (Oct 23)