Executive Summary
| Summary | |
|---|---|
| Title | perl-Archive-Tar security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2010:0505 | First vendor Publication | 2010-07-01 |
| Vendor | RedHat | Last vendor Modification | 2010-07-01 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: An updated perl-Archive-Tar package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - noarch Red Hat Enterprise Linux AS version 4 - noarch Red Hat Enterprise Linux Desktop (v. 5 client) - noarch Red Hat Enterprise Linux Desktop version 4 - noarch Red Hat Enterprise Linux ES version 4 - noarch Red Hat Enterprise Linux WS version 4 - noarch 3. Description: The Archive::Tar module provides a mechanism for Perl scripts to manipulate tar archive files. Multiple directory traversal flaws were discovered in the Archive::Tar module. A specially-crafted tar file could cause a Perl script, using the Archive::Tar module to extract the archive, to overwrite an arbitrary file writable by the user running the script. (CVE-2007-4829) This package upgrades the Archive::Tar module to version 1.39_01. Refer to the Archive::Tar module's changes file, linked to in the References, for a full list of changes. Users of perl-Archive-Tar are advised to upgrade to this updated package, which corrects these issues. All applications using the Archive::Tar module must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 295021 - CVE-2007-4829 perl-Archive-Tar directory traversal flaws |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2010-0505.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11658 | |||
| Oval ID: | oval:org.mitre.oval:def:11658 | ||
| Title: | Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences. | ||
| Description: | Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-4829 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22332 | |||
| Oval ID: | oval:org.mitre.oval:def:22332 | ||
| Title: | RHSA-2010:0505: perl-Archive-Tar security update (Moderate) | ||
| Description: | Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2010:0505-01 CESA-2010:0505 CVE-2007-4829 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | perl-Archive-Tar |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23048 | |||
| Oval ID: | oval:org.mitre.oval:def:23048 | ||
| Title: | ELSA-2010:0505: perl-Archive-Tar security update (Moderate) | ||
| Description: | Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010:0505-01 CVE-2007-4829 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | perl-Archive-Tar |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Os | 4 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for perl-Archive-Tar CESA-2010:0505 centos5 i386 File : nvt/gb_CESA-2010_0505_perl-Archive-Tar_centos5_i386.nasl |
| 2010-07-06 | Name : Perl Archive::Tar Module Remote Directory Traversal Vulnerability File : nvt/gb_perl_archive_tar_26355.nasl |
| 2010-07-02 | Name : RedHat Update for perl-Archive-Tar RHSA-2010:0505-01 File : nvt/gb_RHSA-2010_0505-01_perl-Archive-Tar.nasl |
| 2009-07-29 | Name : Fedora Core 10 FEDORA-2009-7680 (perl) File : nvt/fcore_2009_7680.nasl |
| 2009-02-13 | Name : Fedora Update for perl FEDORA-2008-11736 File : nvt/gb_fedora_2008_11736_perl_fc10.nasl |
| 2009-01-20 | Name : Ubuntu USN-700-2 (perl) File : nvt/ubuntu_700_2.nasl |
| 2009-01-02 | Name : Fedora Core 10 FEDORA-2008-11736 (perl) File : nvt/fcore_2008_11736.nasl |
| 2008-12-29 | Name : Ubuntu USN-700-1 (perl) File : nvt/ubuntu_700_1.nasl |
| 2008-12-23 | Name : Gentoo Security Advisory GLSA 200812-10 (Archive-Tar) File : nvt/glsa_200812_10.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 40410 | Perl Archive::Tar Module TAR Archive Traversal Arbitrary File Overwrite |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2010-0505.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100701_perl_Archive_Tar_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2010-07-28 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0505.nasl - Type : ACT_GATHER_INFO |
| 2010-07-13 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2010-0505.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2008-11736.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-700-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-700-2.nasl - Type : ACT_GATHER_INFO |
| 2008-12-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200812-10.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:53:36 |
|
