Bug Id
16170

Date of Workaround Release
10-OCT-2002

Date of Resolved Release
04-FEB-2003

Impact

A local unprivileged user may be able to gain unauthorized root access and/or overwrite any file on the system if a privileged user extracts a tar or zip archive which contains a ".." (dot dot) in the filename.

For more information see:

• http://online.securityfocus.com/archive/1/196445
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1267
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1268
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1269
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0399

Contributing Factors

This issue can occur in the following releases:

Sun Linux

• Sun Linux 5.0 with tar 1.13.19-6
• Sun Linux 5.0 with unzip version 5.42 or earlier
• Sun Linux 5.0 with GNU tar 1.13.19 or earlier

Note: Sun Linux 5.0 is currently shipped with the Sun LX50 Server.

Sun Cobalt

• Qube 3
• RaQ 3
• RaQ 4
• RaQ 550
• RaQ XTR

Symptoms

There are no reliable symptoms that would show the described issue has been exploited to gain unauthorized root access to a system.

Workaround

Verify zip or tar archives using the options as follows:

	tar -tvf <tarfile>.tar

Or for compressed files:

	tar -tvzf <tarfile>.tar.<gz|zip|Z|z>

Or for zip files:

	unzip -l <zipfile>.zip

If multiple "../" entries are not present, the archive is safe.

Resolution

This issue is addressed in the following releases:

Sun Linux

• Sun Linux 5.0 tar-1.13.25-4.7.1.i386.rpm
• Sun Linux 5.0 unzip-5.50-2.i386.rpm
• Sun Linux 5.0 tar-1.13.25-4.7.1.src.rpm
• Sun Linux 5.0 unzip-5.50-2.src.rpm

The above patches are available at: http://sunsolve.sun.com/patches/linux/security.html

Sun Cobalt

• Qube3-All-Security-4.0.1-16170.pkg
• RaQ3-All-Security-5.0.1-16170.pkg
• RaQ4-All-Security-2.0.2-16170.pkg
• RaQ550-All-Security-0.0.1-16170.pkg
• RaQXTR-All-Security-1.0.1-16170.pkg

The above patches are available at http://sunsolve.sun.com/patches/cobalt/.

Modification History
Date: 04-FEB-2003

• State Resolved (and Closed)
• Updated Contributing Factors and Resolution sections

Product
Sun Linux 5.0

























Attachments

This solution has no attachment