Advisories
Mandriva Advisories
|
 |
| Problem Description |
A directory traversal vulnerability was discovered in GNU tar version
1.13.25 and earlier that allows attackers to overwrite arbitrary files
during extraction of the archive by using a ".." (dot dot) in an
extracted filename.
| Updated Packages |
Mandrakelinux 7.1
e38601b4cf24280c95110c2bb1295860 7.1/RPMS/tar-1.13.25-6.2mdk.i586.rpm 5adf700af4dbd0c483e2957a2006bbbe 7.1/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 7.2
e38601b4cf24280c95110c2bb1295860 7.2/RPMS/tar-1.13.25-6.2mdk.i586.rpm 5adf700af4dbd0c483e2957a2006bbbe 7.2/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 8.0
af16a2a8baa2102e329a9544e5493ab6 8.0/RPMS/tar-1.13.25-6.2mdk.i586.rpm 5adf700af4dbd0c483e2957a2006bbbe 8.0/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 8.0/PPC
538e014cf4eb5e88899627a4a7a481df ppc/8.0/RPMS/tar-1.13.25-6.2mdk.ppc.rpm 5adf700af4dbd0c483e2957a2006bbbe ppc/8.0/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 8.1
271575323590cc758886bd0381d873c1 8.1/RPMS/tar-1.13.25-6.2mdk.i586.rpm 5adf700af4dbd0c483e2957a2006bbbe 8.1/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 8.1/IA64
e2e780f9f79e5584c53bcb0697a17e1b ia64/8.1/RPMS/tar-1.13.25-6.2mdk.ia64.rpm 5adf700af4dbd0c483e2957a2006bbbe ia64/8.1/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 8.2
b75828f0b5158a86477a044cc79b4de8 8.2/RPMS/tar-1.13.25-6.2mdk.i586.rpm 5adf700af4dbd0c483e2957a2006bbbe 8.2/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 8.2/PPC
c37e2b421019e126ac3a63ca7aa42cd6 ppc/8.2/RPMS/tar-1.13.25-6.2mdk.ppc.rpm 5adf700af4dbd0c483e2957a2006bbbe ppc/8.2/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Mandrakelinux 9.0
6486eaafa407b7ee1938b0aa77fecb57 9.0/RPMS/tar-1.13.25-6.2mdk.i586.rpm 5adf700af4dbd0c483e2957a2006bbbe 9.0/SRPMS/tar-1.13.25-6.2mdk.src.rpm
Corporate Server 1.0.1
e38601b4cf24280c95110c2bb1295860 1.0.1/RPMS/tar-1.13.25-6.2mdk.i586.rpm 5adf700af4dbd0c483e2957a2006bbbe 1.0.1/SRPMS/tar-1.13.25-6.2mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1267
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0399
http://online.securityfocus.com/archive/1/196445
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.