rpms/tar
7
0
Fork 0
Code Issues Pull Requests Releases Activity

CVE-2007-4131

Browse Source
This commit is contained in:
Radek Brich 2007-08-28 11:46:09 +00:00
parent 53b3ddfac0
commit 9f1c152faa
2 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
tar-1.17-dot_dot_vuln.patch Normal file
View File

@ -0,0 +1,15 @@
--- tar-1.17/src/names.c.dot_dot_vuln 2007-06-28 18:19:13.000000000 +0200
+++ tar-1.17/src/names.c 2007-08-15 16:29:20.000000000 +0200
@@ -1009,11 +1009,10 @@ contains_dot_dot (char const *name)
if (p[0] == '.' && p[1] == '.' && (ISSLASH (p[2]) || !p[2]))
return 1;
- do
+ while (! ISSLASH (*p))
{
if (! *p++)
return 0;
}
- while (! ISSLASH (*p));
}
}

10
tar.spec
View File

@ -2,8 +2,8 @@ Summary: A GNU file archiving program
Name: tar Name: tar
Epoch: 2 Epoch: 2
Version: 1.17 Version: 1.17
Release: 1%{?dist} Release: 2%{?dist}
License: GPL License: GPLv2+
Group: Applications/Archiving Group: Applications/Archiving
URL: http://www.gnu.org/software/tar/ URL: http://www.gnu.org/software/tar/
Source0: ftp://ftp.gnu.org/pub/gnu/tar/tar-%{version}.tar.gz Source0: ftp://ftp.gnu.org/pub/gnu/tar/tar-%{version}.tar.gz
@ -14,6 +14,7 @@ Patch2: tar-1.15.1-vfatTruncate.patch
Patch3: tar-1.17-testsuite.patch Patch3: tar-1.17-testsuite.patch
Patch4: tar-1.17-xattrs.patch Patch4: tar-1.17-xattrs.patch
Patch5: tar-1.17-wildcards.patch Patch5: tar-1.17-wildcards.patch
Patch6: tar-1.17-dot_dot_vuln.patch
Prereq: info Prereq: info
BuildRequires: autoconf automake gzip texinfo gettext libacl-devel libselinux-devel BuildRequires: autoconf automake gzip texinfo gettext libacl-devel libselinux-devel
Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Buildroot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@ -39,6 +40,7 @@ the rmt package.
%patch3 -p1 -b .testsuite %patch3 -p1 -b .testsuite
%patch4 -p1 -b .xattrs %patch4 -p1 -b .xattrs
%patch5 -p1 -b .wildcards %patch5 -p1 -b .wildcards
%patch6 -p1 -b .dot_dot_vuln.patch
%build %build
%configure --bindir=/bin --libexecdir=/sbin %configure --bindir=/bin --libexecdir=/sbin
@ -89,6 +91,10 @@ fi
%{_infodir}/tar.info* %{_infodir}/tar.info*
%changelog %changelog
* Tue Aug 28 2007 Radek Brich <rbrich@redhat.com> 2:1.17-2
- updated license tag
- fixed CVE-2007-4131 tar directory traversal vulnerability (#251921)
* Thu Jun 28 2007 Radek Brich <rbrich@redhat.com> 2:1.17-1 * Thu Jun 28 2007 Radek Brich <rbrich@redhat.com> 2:1.17-1
- new upstream version - new upstream version
- patch for wildcards (#206841), restoring old behavior - patch for wildcards (#206841), restoring old behavior