Debian Bug report logs - #440097
CVE-2007-4559: directory traversal vulnerability in python tarfile module

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Stefan Fritsch <sf@sfritsch.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2007-4559: directory traversal vulnerability in python tarfile module

Date: Wed, 29 Aug 2007 20:39:35 +0200

Package: python2.4
Version: 2.4.4-3
Severity: grave
Tags: security
Justification: user security hole

A vulnerability has been found in the  python tarfile module.
>From CVE-2007-4559:


"Directory traversal vulnerability in the (1) extract and (2) extractall
functions in the tarfile module in Python allows user-assisted remote attackers
to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR
archive, a related issue to CVE-2001-1267."

Please mention the CVE id in the changelog.

Message #14 received at 440097@bugs.debian.org (full text, mbox, reply):

From: Matthias Klose <doko@cs.tu-berlin.de>

To: Stefan Fritsch <sf@sfritsch.de>, 440097@bugs.debian.org, 440099@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#440097: CVE-2007-4559: directory traversal vulnerability in python tarfile module

Date: Sat, 1 Sep 2007 19:34:01 +0200

tag 440097 - security
severity 440097 important
tag 440099 - security
severity 440099 important
thanks

upstream doesn't see this as a security issue; I don't mind mentioning
the CVE for a fix, once a patch is available in the upstream
repositories.

Stefan Fritsch writes:
> Package: python2.4
> Version: 2.4.4-3
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> A vulnerability has been found in the  python tarfile module.
> >From CVE-2007-4559:
> 
> 
> "Directory traversal vulnerability in the (1) extract and (2) extractall
> functions in the tarfile module in Python allows user-assisted remote attackers
> to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR
> archive, a related issue to CVE-2001-1267."
> 
> Please mention the CVE id in the changelog.

Message #23 received at 440097@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 440099@bugs.debian.org, 440097@bugs.debian.org

Cc: sf@sfritsch.de, control@bugs.debian.org

Subject: Re: CVE-2007-4559: directory traversal vulnerability in python tarfile moduleCVE-2007-4559: directory traversal vulnerability in python tarfile module

Date: Thu, 11 Oct 2007 17:15:34 +0200

[Message part 1 (text/plain, inline)]

tags 440097 + security
tags 440099 + security
thanks

Hi Matthias,
After speaking with Kees Cook and Sean Finney in 
#debian-security we all agreed that this *is* indeed a 
security issue even if upstream does not agree here.
It is a valid argument that a user is supposed to extract a 
tar archive in a secure way. It is not the job of the user 
to take care of directory traversal logic via path names or  
symlinks with examining the tar archive first.
Thus readding the security tag.

Kind regards
Nico

-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #30 received at 440097@bugs.debian.org (full text, mbox, reply):

From: Loïc Minier <lool@dooz.org>

To: Nico Golde <nion@debian.org>, 440099@bugs.debian.org

Cc: 440097@bugs.debian.org, sf@sfritsch.de

Subject: Re: Bug#440099: CVE-2007-4559: directory traversal vulnerability in python tarfile moduleCVE-2007-4559: directory traversal vulnerability in python tarfile module

Date: Thu, 28 Aug 2008 13:41:36 +0200

On Thu, Aug 28, 2008, Loïc Minier wrote:
>  I'm not sure what to think here;  behavior with ../ and absolute
>  pathnames is documented behavior in the tarfile API.
> 
>  Another thing which is not strongly advertized is that if your tarball
>  has 0777 directories, extractall() will happily create 0777
>  directories.

 (Note that I discovered about this bug when I noticed that bzr
 build-deb would create 0777 directories when building hal.)

-- 
Loïc Minier

Message #35 received at 440097@bugs.debian.org (full text, mbox, reply):

From: Loïc Minier <lool@dooz.org>

To: Nico Golde <nion@debian.org>, 440099@bugs.debian.org

Cc: 440097@bugs.debian.org, sf@sfritsch.de

Subject: Re: Bug#440099: CVE-2007-4559: directory traversal vulnerability in python tarfile moduleCVE-2007-4559: directory traversal vulnerability in python tarfile module

Date: Thu, 28 Aug 2008 13:40:58 +0200

On Thu, Oct 11, 2007, Nico Golde wrote:
> After speaking with Kees Cook and Sean Finney in 
> #debian-security we all agreed that this *is* indeed a 
> security issue even if upstream does not agree here.
> It is a valid argument that a user is supposed to extract a 
> tar archive in a secure way. It is not the job of the user 
> to take care of directory traversal logic via path names or  
> symlinks with examining the tar archive first.
> Thus readding the security tag.

 I'm not sure what to think here;  behavior with ../ and absolute
 pathnames is documented behavior in the tarfile API.

 Another thing which is not strongly advertized is that if your tarball
 has 0777 directories, extractall() will happily create 0777
 directories.

 (Try with the hal tarball for instance.)

 Note that "tar" will do the same if you run it as root!!

-- 
Loïc Minier

Send a report that this bug log contains spam.