[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <13512806.1ZGcyoO27t@sarpedon>
Date: Fri, 23 Oct 2015 07:15:53 +0100
From: Tim Brown <tmb@...35.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: BusyBox tar directory traversal
On Thursday 22 October 2015 22:40:29 Robert Watson wrote:
> Apologies if I'm naive but... since /tmp is world writable, how is this a
> vulnerability?
The permissions on /tmp having nothing at all to do with this, not sure why
you brought that up. With most archiving tools, there is an expectation that
unpacking will involve writing only to the current directory and below and/or
a user specified directory and below. This breaks that assumption because the
unpacker may create a symlink to a location outside of the directory which
later may then be followed when further files are unpacked. Depending on the
user permissions, this could lead to sensitive files being overwritten. Even if
the unpacker validates the path it is writing to is as described, the
validation fails to account for the potential presence of symbolic link files
that point elsewhere.
Tim
--
Tim Brown
<mailto:tmb@...35.com>
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
