bugGNU tar - Bugs: bug #18355, GNUTYPE_NAMES can allow writing to...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #18355: GNUTYPE_NAMES can allow writing to arbitrary locations

Submitted by:  Kees Cook <keescook>
Submitted on:  Thu 23 Nov 2006 04:48:29 AM UTC  
Votes:  1  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Thu 23 Nov 2006 04:48:29 AM UTC, original submission:

As demonstrated here, GNUTYPE_NAMES is dangerous:

http://archives.neohapsis.com/archives/fulldisclosure/2006-11/0344.html

One solution is for GNUTYPE_NAMES processing to be disabled by default. Patch attached.

Kees Cook <keescook>

 

Attached Files
file #11327:  tar-mangling.patch added by keescook (2KiB - text/x-patch - disable GNUTYPE_NAMES by default, add --allow-name-mangling)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gray (Updated the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 1 encouragement so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 09 Dec 2006 02:42:53 PM UTCgrayStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Sun 26 Nov 2006 04:52:54 PM UTCzardozCarbon-Copy-=>Added zardoz
    Thu 23 Nov 2006 04:49:29 AM UTCkeescookAttached File-=>Added tar-mangling.patch, #11327
    Thu 23 Nov 2006 04:48:29 AM UTCkeescookAttached File-=>Added tar-mangle.patch, #11326

    Back to the top


    Powered by Savane 3.1-cleanup1