GLSA 201702-32: Ruby Archive::Tar::Minitar: Directory traversal

Severity:normal
Title:Ruby Archive::Tar::Minitar: Directory traversal
Date:02/22/2017
Bugs: #607110
ID:201702-32

Synopsis

Ruby Archive::Tar::Minitar is vulnerable to a directory traversal attack.

Background

Archive::Tar::Minitar is a pure-Ruby library and command-line utility that provides the ability to deal with POSIX tar(1) archive files.

Affected packages

Package Vulnerable Unaffected Architecture(s)
dev-ruby/archive-tar-minitar < 0.6.1 >= 0.6.1 All supported architectures

Description

Michal Marek discovered that Ruby Archive::Tar::Minitar is vulnerable to a directory traversal vulnerability.

Impact

A remote attacker could entice a user or an automated system to process a specially crafted archive using Ruby Archive::Tar::Minitar possibly allowing the writing of arbitrary files with the privileges of the process.

Workaround

There is no known workaround at this time.

Resolution

All Ruby Archive::Tar::Minitar users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose
      ">=dev-ruby/archive-tar-minitar-0.6.1"
    

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201702-32.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

Thank you!