CERTA-2006-AVI-092

Vulnerability from certfr_avis - Published: - Updated:

None

Description

Une vulnérabilité a été découverte dans GNU tar. Cette vulnérabilité peut être exploitée par l'intermédiaire d'un fichier .tar malicieusement construit, afin d'exécuter des commandes arbitraires par le biais d'un débordement de mémoire.

Solution

La version 1.15.90 (alpha) corrige cette vulnérabilité.

GNU tar version 1.15.1 et versions antérieures.

Impacted products
Vendor Product Description
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eGNU tar version 1.15.1 et versions  ant\u00e9rieures.\u003c/p\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans GNU tar. Cette vuln\u00e9rabilit\u00e9\npeut \u00eatre exploit\u00e9e par l\u0027interm\u00e9diaire d\u0027un fichier .tar malicieusement\nconstruit, afin d\u0027ex\u00e9cuter des commandes arbitraires par le biais d\u0027un\nd\u00e9bordement de m\u00e9moire.\n\n## Solution\n\nLa version 1.15.90 (alpha) corrige cette vuln\u00e9rabilit\u00e9.\n",
  "cves": [
    {
      "name": "CVE-2006-0300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0300"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-987 du 07 mars 2006 :",
      "url": "http://www.debian.org/security/dsa-987"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:046 du 21 f\u00e9vrier    2006 :",
      "url": "http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:046"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200603-06 du 10 mars 2006    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200603-06.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-257-1 du 23 f\u00e9vrier 2006 :",
      "url": "http://www.ubuntu.com/usn/usn-257-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SR:2006:005 du 03 mars 2006    :",
      "url": "http://www.novell.com/linux/security/advisories/2006_05_sr.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0232 du 01 mars 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0232.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD pour gtar du 03 mars 2006 :",
      "url": "http://www.vuxml.org/freebsd/pkg-gtar.html"
    }
  ],
  "reference": "CERTA-2006-AVI-092",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-02-24T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Mandriva, Ubuntu et RedHat.",
      "revision_date": "2006-03-02T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 FreeBSD et Debian.",
      "revision_date": "2006-03-08T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 SUSE et Gentoo.",
      "revision_date": "2006-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 de GNU tar",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de mise \u00e0 jour de GNU tar",
      "url": "http://lists.gnu.org/archive/html/bug-tar/2006-02/msg00051.html"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.