Archive::Tar: Directory traversal vulnerability

Archive::Tar: Directory traversal vulnerability A directory traversal vulnerability has been discovered in Archive::Tar. Archive-Tar 2008-12-10 2008-12-10 192989 remote 1.40 1.40

Archive::Tar is a Perl module for creation and manipulation of tar files.

Jonathan Smith of rPath reported that Archive::Tar does not check for ".." in file names.

A remote attacker could entice a user or automated system to extract a specially crafted tar archive, overwriting files at arbitrary locations outside of the specified directory.

There is no known workaround at this time.

All Archive::Tar users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=perl-core/Archive-Tar-1.40"

CVE-2007-4829 rbu rbu rbu