Test ID:	1.3.6.1.4.1.25623.1.0.702863
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 2863-1 (libtar - directory traversal)
Summary:	A directory traversal attack was reported against libtar, a C library for;manipulating tar archives. The application does not validate the;filenames inside the tar archive, allowing to extract files in arbitrary;path. An attacker can craft a tar file to override files beyond the;tar_extract_glob and tar_extract_all prefix parameter.
Description:	Summary: A directory traversal attack was reported against libtar, a C library for manipulating tar archives. The application does not validate the filenames inside the tar archive, allowing to extract files in arbitrary path. An attacker can craft a tar file to override files beyond the tar_extract_glob and tar_extract_all prefix parameter. Affected Software/OS: libtar on Debian Linux Solution: For the oldstable distribution (squeeze), this problem has been fixed in version 1.2.11-6+deb6u2. For the stable distribution (wheezy), this problem has been fixed in version 1.2.16-1+deb7u2. For the unstable distribution (sid), this problem has been fixed in version 1.2.20-2. We recommend that you upgrade your libtar packages. CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-4420 Debian Security Information: DSA-2863 (Google Search) http://www.debian.org/security/2014/dsa-2863 https://lists.feep.net:8080/pipermail/libtar/2014-February/000403.html
Copyright	Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.