GLSA 201702-32: Ruby Archive::Tar::Minitar: Directory traversal

http://security.gentoo.org/

Severity:	normal
Title:	Ruby Archive::Tar::Minitar: Directory traversal
Date:	02/22/2017
Bugs:	#607110
ID:	201702-32

Synopsis

Ruby Archive::Tar::Minitar is vulnerable to a directory traversal attack.

Background

Archive::Tar::Minitar is a pure-Ruby library and command-line utility that provides the ability to deal with POSIX tar(1) archive files.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
dev-ruby/archive-tar-minitar	< 0.6.1	>= 0.6.1	All supported architectures

Description

Michal Marek discovered that Ruby Archive::Tar::Minitar is vulnerable to a directory traversal vulnerability.

Impact

A remote attacker could entice a user or an automated system to process a specially crafted archive using Ruby Archive::Tar::Minitar possibly allowing the writing of arbitrary files with the privileges of the process.

Workaround

There is no known workaround at this time.

Resolution

All Ruby Archive::Tar::Minitar users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose
      ">=dev-ruby/archive-tar-minitar-0.6.1"

References

CVE-2016-10173

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201702-32.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.