CERTA-2006-AVI-092
Vulnerability from certfr_avis

None

Description

Une vulnérabilité a été découverte dans GNU tar. Cette vulnérabilité peut être exploitée par l'intermédiaire d'un fichier .tar malicieusement construit, afin d'exécuter des commandes arbitraires par le biais d'un débordement de mémoire.

Solution

La version 1.15.90 (alpha) corrige cette vulnérabilité.

GNU tar version 1.15.1 et versions antérieures.

Impacted products
Vendor Product Description
References

Show details on source website

To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eGNU tar version 1.15.1 et versions  ant\u00e9rieures.\u003c/p\u003e",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans GNU tar. Cette vuln\u00e9rabilit\u00e9\npeut \u00eatre exploit\u00e9e par l\u0027interm\u00e9diaire d\u0027un fichier .tar malicieusement\nconstruit, afin d\u0027ex\u00e9cuter des commandes arbitraires par le biais d\u0027un\nd\u00e9bordement de m\u00e9moire.\n\n## Solution\n\nLa version 1.15.90 (alpha) corrige cette vuln\u00e9rabilit\u00e9.\n",
  "cves": [
    {
      "name": "CVE-2006-0300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0300"
    }
  ],
  "initial_release_date": "2006-02-24T00:00:00",
  "last_revision_date": "2006-03-13T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-987 du 07 mars 2006 :",
      "url": "http://www.debian.org/security/dsa-987"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDKSA-2006:046 du 21 f\u00e9vrier    2006 :",
      "url": "http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:046"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200603-06 du 10 mars 2006    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200603-06.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-257-1 du 23 f\u00e9vrier 2006 :",
      "url": "http://www.ubuntu.com/usn/usn-257-1"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SR:2006:005 du 03 mars 2006    :",
      "url": "http://www.novell.com/linux/security/advisories/2006_05_sr.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0232 du 01 mars 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0232.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD pour gtar du 03 mars 2006 :",
      "url": "http://www.vuxml.org/freebsd/pkg-gtar.html"
    }
  ],
  "reference": "CERTA-2006-AVI-092",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-02-24T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 Mandriva, Ubuntu et RedHat.",
      "revision_date": "2006-03-02T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 FreeBSD et Debian.",
      "revision_date": "2006-03-08T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 SUSE et Gentoo.",
      "revision_date": "2006-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 de GNU tar",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de mise \u00e0 jour de GNU tar",
      "url": "http://lists.gnu.org/archive/html/bug-tar/2006-02/msg00051.html"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.