Re: CVE Request: BusyBox tar directory traversal

[Robert Watson <robertcwatson1 () gmail com>]

If the user unpacking the tar does not have write access to the target
directory of the symlink, won't the write of that file fail?

If the unpacking user *does* have write access to the symlink target
directory, but the file already exists in that directory, however the user
does not have write-access to that file, won't the write fail then as well?

A common use-case for tar is writing to a single directory and below as you
say. But it is by no means the only capability.

Remember that tar was created primarily for software distribution and
compressed tar files are most often used to this day for that purpose.
Software distribution almost always involves writing files to many
different directories at all levels of the filesystem. Symlinks between
them are quite common as well.

What am I misunderstanding?




*Trust in truth keeps hope aliverobertcwatson1 () gmail com
<robertcwatson1 () gmail com>www.docsalvage.info
<http://www.docsalvage.info>www.CivicChorale.org
<http://www.CivicChorale.org>*
<http://www.wunderground.com/cgi-bin/findweather/getForecast?query=Tallahassee,%20FL>
<https://www.healthcare.gov/>

On Fri, Oct 23, 2015 at 2:15 AM, Tim Brown <tmb () 65535 com> wrote:

> On Thursday 22 October 2015 22:40:29 Robert Watson wrote:
> > Apologies if I'm naive but... since /tmp is world writable, how is this a
> > vulnerability?
>
> The permissions on /tmp having nothing at all to do with this, not sure why
> you brought that up. With most archiving tools, there is an expectation
> that
> unpacking will involve writing only to the current directory and below
> and/or
> a user specified directory and below. This breaks that assumption because
> the
> unpacker may create a symlink to a location outside of the directory which
> later may then be followed when further files are unpacked. Depending on
> the
> user permissions, this could lead to sensitive files being overwritten.
> Even if
> the unpacker validates the path it is writing to is as described, the
> validation fails to account for the potential presence of symbolic link
> files
> that point elsewhere.
>
> Tim
> --
> Tim Brown
> <mailto:tmb () 65535 com>