[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [FD] [CSS] POINTYFEATHER / tar extract pathname bypass (CVE-2016-6321) - patch update
From: Harry Sintonen <fulldisclosure () kyber ! fi>
Date: 2016-10-30 1:03:07
Message-ID: alpine.DEB.2.11.1610300349100.4373 () o7 ! fi
[Download RAW message or body]
Update on the advisory: As pointed out by several people, the ERROR
macro did't fail the operation in a desired way: Files were still
being created by tar. In order to really stop tar from doing silly
things, FATAL_ERROR macro needs to be used instead.
The patch has now been updated accordingly.
Updated Advisory:
https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt
Updated Patch:
https://sintonen.fi/advisories/tar-extract-pathname-bypass.patch
NOTE: Ideas on how to make tar safely skip such entries instead of
failing the whole operating are welcome.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic