Bug #30380 for Archive-Tar: directory traversal vulnerability in Archive-Tar

On Tue Oct 30 22:44:05 2007, smithj@freethemallocs.com wrote: Show quoted text
Thanks for bringing this to my attention. A similar report was made a few weeks ago (but seemingly unrelated to rPath) here: https://rt.cpan.org/Ticket/Display.html?id=29517 We'll take this issue under advisement.

Greetings, On Tue Oct 30 22:44:05 2007, smithj@freethemallocs.com wrote: Show quoted text
I have just uploaded a development version of Archive::Tar [1] to CPAN, which should address this is issue. It may take a little while untill it has propagated around the CPAN mirrors. Please let me know if this addresses the issue fully, and we'll release it as a stable version and merge it back into the perl core. Thanks again for reporting, Jos Boumans [1] http://search.cpan.org/~kane/Archive-Tar-1.37_01/

Show quoted text
Hello, the problem with absolute paths in filenames and directory traversal seems to be fixed, many thanks. But there is one more related, very similar issue, which has not been addressed yet. If you run: rm -rf dir && mkdir dir && ln -s .//..//..//..//..//..//..//..//..//..//..//etc dir/subdir && tar -cf dir.tar --numeric-owner --owner=0 --group=0 dir/subdir dir/subdir/passwd and then use Archive::Tar; my $tar = Archive::Tar->new($ARGV[0]); $tar->extract(); on your archive, you will get attempt to rewrite /etc/passwd: mkdir("/tmp/wtf/dir", 0777) = 0 symlink("./../../../../../../../../etc", "/tmp/wtf/dir/subdir") = 0 ... open("/tmp/wtf/dir/subdir/passwd", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied) I have played with a possible ways to fix this second issue and it seems that the only way to fix is to remember all the symlinks you create when deciding which ones to follow. Anicka

Anicka: Having a file in a tarball, not its parent directory, but a symlink named as its parent directory is by no means sane and useful. I would expect attempt extract from such archive to fail with an error about nonexistent path to the destination file. Show quoted text
You know it doesn't sound well. Possible resolution is not to follow symlinks while extracting (it's not useful, see first paragraph). That would be done like this: --- /usr/lib/perl5/vendor_perl/5.8.8/Archive/Tar.pm.orig 2008-02-22 15:22:05.000000000 +0100 +++ /usr/lib/perl5/vendor_perl/5.8.8/Archive/Tar.pm 2008-02-22 15:21:28.000000000 +0100 @@ -595,7 +595,7 @@ sub _extract_file { if( length $entry->type && $entry->is_file ) { my $fh = IO::File->new; - $fh->open( '>' . $full ) or ( + $fh->open( '>' . $full, O_NOFOLLOW ) or ( $self->_error( qq[Could not open file '$full': $!] ), return ); Note that the same would need to be done for directories and special files too. Currently it's probably not a good idea, as it would break extraction if working directory path contained a symlink due to the code below (note that I haven't tried that nor read that extensively, I might be wrong): 549 my $cwd = (defined $self->{cwd} ? $self->{cwd} : cwd()); 550 my @dirs = File::Spec::Unix->splitdir( $dirs ); 551 my @cwd = File::Spec->splitdir( $cwd ); 552 $dir = File::Spec->catdir( @cwd, @dirs ); Is something wrong with nofollow approach? -- Lubomir Kundrak (Red Hat Security Response Team)

I've just uploaded 1.39_01, which should address the second part of this issue. Unfortunately, O_FOLLOW can't be used, as it's not portable, but i've implemented a fix on the code level with the same intention. From the changes file: * important changes in version 1.39_01 22/08/2008: - Address the second part mentioned in this report: #30380: directory traversal vulnerability in Archive-Tar Archives are no longer allowed to extract into symlinked directories, unless Insecure Extract Mode is enabled (which is off by default).