#VU32213 Path traversal in Tar - CVE-2016-6321 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32213

#VU32213 Path traversal in Tar - CVE-2016-6321

Published: December 10, 2016 / Updated: July 28, 2020


Vulnerability identifier: #VU32213
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-6321
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Tar
Software vendor:
GNU

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.


Remediation

Install update from vendor's website.

External links