Vulnerability in GNU "tar"
Linux distributor Red Hat has discovered a vulnerability in the GNU "tar" program that could allow attackers to overwrite files.
Red Hat describes the vulnerability as a directory traversal error, stating that attackers could use manipulated archvies to exploit the bug. "../" directory entries give the attacker the ability to overwrite files for which the executing user has write permissions. The security hole is due to faulty "contains_dot_dot()" function in the "names.c" file. Both Red Hat and the Secunia security service have classified the vulnerability as moderate.
The error affects GNU tar version 1.18 and older. An update and a patch by Red Hat are already available. Other distributions can be expected to follow suit. Users are advised to update their systems.
Issue 171/2015
Buy this issue as a PDF
News
-
Intel Unveils Compute Stick
Four-inch-long computer on a stick lets you boot a full Linux system from any HDMI display device.
-
Obama Proposes Personal Data Notification Law
New statute would require companies to report break-ins to consumers.
-
TGXf Project Warns of File Transfer through Screen Pixels
Weird data transfer technique avoids all standard security measures.
-
Industry Giants Announce a Fix for the Password Mess
FIDO alliance declares the beginning of the end for old-style login authentication.
-
Poll: Vote for the Best Open Source Software for Photographers
The Linux New Media Awards have honored the most significant products, projects, people, and organizations for open source/Linux every year since 2000.
-
Debian Gets Forked
Legendary Uber-distro splits over the systemd controversy.
-
Linux Mint Project Releases Mint 17.1
New LTS version offers many refinements for the Cinnamon and Mate desktops and significant improvement under the hood.
-
CeBIT Open Source Forum Call for Papers
One of CeBIT’s most successful forums returns in 2015.
-
TOR Network Isn’t So Anonymous
A new study says it is possible to unmask 81% of TOR users.
-
.NET Goes Open Source
Redmond joins the revolution by turning the .NET Core Runtime into a GitHub project.