|Category:||Red Hat Local Security Checks|
|Title:||RedHat Security Advisory RHSA-2007:0873|
The remote host is missing updates announced in
Star is a tar-like archiver. It saves multiple files into a single tape or
disk archive, and can restore individual files from the archive. Star
includes multi-volume support, automatic archive format detection and ACL
A path traversal flaw was discovered in the way star extracted archives. A
malicious user could create a tar archive that would cause star to write to
arbitrary files to which the user running star had write access.
Red Hat would like to thank Robert Buchholz for reporting this issue.
As well, this update adds the command line argument -.. to the Red Hat
Enterprise Linux 3 version of star. This allows star to extract files
containing /../ in their pathname.
Users of star should upgrade to this updated package, which contain
backported patches to correct these issues.
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
Risk factor : High
Common Vulnerability Exposure (CVE) ID: CVE-2007-4134|
Bugtraq: 20070907 FLEA-2007-0051-1 star (Google Search)
SGI Security Advisory: 20070901-01-P
|Copyright||Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com|
|This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.