On Fri, Dec 26, 2008 at 09:54:16PM +0100, Nico Golde wrote:
> > > on your archive, you will get attempt to rewrite /etc/passwd:
> >
> > This was fixed upstream in 1.39_01. Ubuntu backported the fix recently
> > for 5.10.0-11.1ubuntu2.2; I'm attaching their patch.
>
> Is this different from CVE-2007-4829 which is fixed in
> libarchive-tar-perl 1.38-1 referring to
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449544?
Ubuntu calls it the "second half of unpack issue CVE-2007-4829".
I understand upstream 1.38 (or 1.37_01, to be precise) fixed unpacking
absolute and '../../' paths but still followed symlinks. This was fixed
upstream in 1.39_01.
So perl-modules/5.10.0-* and libarchive-tar-perl/1.38-1 are equally vulnerable
(but the latter has since been removed from lenny/sid.)
I'm reviewing the Ubuntu patch, and I wonder if the caching of the stat()
result for symlink detection ($self->{_link_cache}) is a problem.
The worst I can currently think of is an easy race when somebody is
extracting a malicious tar file in a world-writable directory like
/tmp. This setting can probably be dismissed as too contrived.
If there was a way to ship both a regular file and a symlink in the tar
file so that the symlink would replace the regular file later, it could
fool the cache. However, that doesn't seem to be the case.
Otherwise, the patch looks OK although not strictly minimal. It looks like
the new tests don't really get executed without running them manually,
but they don't hurt.
I'll see if I can get this into lenny.
--
Niko Tyni [email protected]
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
