CVEvulnerability
CVE-2005-1918
2.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2005-12-31
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-22
Description
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
Affected configurations
• gnu tar 1.13.25
• redhat enterprise linux 2.1
• redhat enterprise linux 3.0
• redhat enterprise linux desktop 3.0
• redhat linux advanced workstation 2.1
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc patches.sgi.com
- http://secunia.com/advisories/18988 Patch, Vendor Advisory
- http://secunia.com/advisories/19130 Vendor Advisory
- http://secunia.com/advisories/19183 Patch, Vendor Advisory
- http://secunia.com/advisories/20397 Vendor Advisory
- http://securitytracker.com/id?1015655 Patch
- http://support.avaya.com/elmodocs2/security/ASA-2006-110.htm support.avaya.com
- http://www.novell.com/linux/security/advisories/2006_05_sr.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2006-0195.html Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/430297/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/5834 Patch
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=140589 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9946 oval.cisecurity.org
- ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc patches.sgi.com
- http://secunia.com/advisories/18988 Patch, Vendor Advisory
- http://secunia.com/advisories/19130 Vendor Advisory
- http://secunia.com/advisories/19183 Patch, Vendor Advisory
- http://secunia.com/advisories/20397 Vendor Advisory
- http://securitytracker.com/id?1015655 Patch
- http://support.avaya.com/elmodocs2/security/ASA-2006-110.htm support.avaya.com
- http://www.novell.com/linux/security/advisories/2006_05_sr.html Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2006-0195.html Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/430297/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/5834 Patch
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=140589 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9946 oval.cisecurity.org