Home / mailings [RHSA-2007:0873-01] Moderate: star security update
Posted on 04 September 2007
RedHat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Moderate: star security update
Advisory ID: RHSA-2007:0873-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0873.html
Issue date: 2007-09-04
Updated on: 2007-09-04
Product: Red Hat Enterprise Linux
Keywords: path traversal
CVE Names: CVE-2007-4134
- ---------------------------------------------------------------------
1. Summary:
An updated star package that fixes a path traversal flaw is now available.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
3. Problem description:
Star is a tar-like archiver. It saves multiple files into a single tape or
disk archive, and can restore individual files from the archive. Star
includes multi-volume support, automatic archive format detection and ACL
support.
A path traversal flaw was discovered in the way star extracted archives. A
malicious user could create a tar archive that would cause star to write to
arbitrary files to which the user running star had write access.
(CVE-2007-4134)
Red Hat would like to thank Robert Buchholz for reporting this issue.
As well, this update adds the command line argument "-.." to the Red Hat
Enterprise Linux 3 version of star. This allows star to extract files
containing "/../" in their pathname.
Users of star should upgrade to this updated package, which contain
backported patches to correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
253856 - CVE-2007-4134 star directory traversal vulnerability
6. RPMs required:
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/star-1.5a08-5.src.rpm
eb60c4d98794cc4331db4853ef4ddffb star-1.5a08-5.src.rpm
i386:
8d0acc63d8b6581d31a47898ec0f3408 star-1.5a08-5.i386.rpm
2386eeedcd02301ad75d0a051858d726 star-debuginfo-1.5a08-5.i386.rpm
ia64:
0b96bc977983d286b85b09321ce9cfc0 star-1.5a08-5.ia64.rpm
df0e48433bbe7a1b041fdccbde2de76a star-debuginfo-1.5a08-5.ia64.rpm
ppc:
108660e211b16f43661aceb7ba78b498 star-1.5a08-5.ppc.rpm
ea3bf509f4403d2887467b1d686bd683 star-debuginfo-1.5a08-5.ppc.rpm
s390:
9bde61312d7d4965ddf73fb9ac1d6f89 star-1.5a08-5.s390.rpm
0909d62526931d1aaea1cbf26a538c02 star-debuginfo-1.5a08-5.s390.rpm
s390x:
a0ee684e324affe6f2f456a00529c2c8 star-1.5a08-5.s390x.rpm
d4e418b49de67b8f12a1798d17b12f4a star-debuginfo-1.5a08-5.s390x.rpm
x86_64:
602b1f975b422178fa2a15db98c88b01 star-1.5a08-5.x86_64.rpm
75ee94e2e1df94b4bd2ef55fab7f14f1 star-debuginfo-1.5a08-5.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/star-1.5a08-5.src.rpm
eb60c4d98794cc4331db4853ef4ddffb star-1.5a08-5.src.rpm
i386:
8d0acc63d8b6581d31a47898ec0f3408 star-1.5a08-5.i386.rpm
2386eeedcd02301ad75d0a051858d726 star-debuginfo-1.5a08-5.i386.rpm
x86_64:
602b1f975b422178fa2a15db98c88b01 star-1.5a08-5.x86_64.rpm
75ee94e2e1df94b4bd2ef55fab7f14f1 star-debuginfo-1.5a08-5.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/star-1.5a08-5.src.rpm
eb60c4d98794cc4331db4853ef4ddffb star-1.5a08-5.src.rpm
i386:
8d0acc63d8b6581d31a47898ec0f3408 star-1.5a08-5.i386.rpm
2386eeedcd02301ad75d0a051858d726 star-debuginfo-1.5a08-5.i386.rpm
ia64:
0b96bc977983d286b85b09321ce9cfc0 star-1.5a08-5.ia64.rpm
df0e48433bbe7a1b041fdccbde2de76a star-debuginfo-1.5a08-5.ia64.rpm
x86_64:
602b1f975b422178fa2a15db98c88b01 star-1.5a08-5.x86_64.rpm
75ee94e2e1df94b4bd2ef55fab7f14f1 star-debuginfo-1.5a08-5.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/star-1.5a08-5.src.rpm
eb60c4d98794cc4331db4853ef4ddffb star-1.5a08-5.src.rpm
i386:
8d0acc63d8b6581d31a47898ec0f3408 star-1.5a08-5.i386.rpm
2386eeedcd02301ad75d0a051858d726 star-debuginfo-1.5a08-5.i386.rpm
ia64:
0b96bc977983d286b85b09321ce9cfc0 star-1.5a08-5.ia64.rpm
df0e48433bbe7a1b041fdccbde2de76a star-debuginfo-1.5a08-5.ia64.rpm
x86_64:
602b1f975b422178fa2a15db98c88b01 star-1.5a08-5.x86_64.rpm
75ee94e2e1df94b4bd2ef55fab7f14f1 star-debuginfo-1.5a08-5.x86_64.rpm
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/star-1.5a25-8.src.rpm
2a15a59bd63fc8657c8a5de1097a0e36 star-1.5a25-8.src.rpm
i386:
cec9ee628151fa5e57a8313b8d7e7d81 star-1.5a25-8.i386.rpm
41c683a0720e5cfb3c034fb4257e923c star-debuginfo-1.5a25-8.i386.rpm
ia64:
a9070af290f4e3aaee258428abbd6928 star-1.5a25-8.ia64.rpm
f0abaccb1c714fefa03c2bdd61ffbc4b star-debuginfo-1.5a25-8.ia64.rpm
ppc:
cc849ee1748afe9b30c223f97ac494cd star-1.5a25-8.ppc.rpm
c46d3c671b35d654f87489bd1652aeb2 star-debuginfo-1.5a25-8.ppc.rpm
s390:
7d70e8860e502b9ac0ac349720c7cf96 star-1.5a25-8.s390.rpm
b232c4ec1ea6fc5222209cfdabd407dd star-debuginfo-1.5a25-8.s390.rpm
s390x:
bab6e74335bd2e753f197a2b5ed9e760 star-1.5a25-8.s390x.rpm
bbabf7d1c985bda1b9ea75d69b175ff2 star-debuginfo-1.5a25-8.s390x.rpm
x86_64:
84c057a5e76010e931ede389164aba22 star-1.5a25-8.x86_64.rpm
9f17013824a0bca695a1996d77105638 star-debuginfo-1.5a25-8.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/star-1.5a25-8.src.rpm
2a15a59bd63fc8657c8a5de1097a0e36 star-1.5a25-8.src.rpm
i386:
cec9ee628151fa5e57a8313b8d7e7d81 star-1.5a25-8.i386.rpm
41c683a0720e5cfb3c034fb4257e923c star-debuginfo-1.5a25-8.i386.rpm
x86_64:
84c057a5e76010e931ede389164aba22 star-1.5a25-8.x86_64.rpm
9f17013824a0bca695a1996d77105638 star-debuginfo-1.5a25-8.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/star-1.5a25-8.src.rpm
2a15a59bd63fc8657c8a5de1097a0e36 star-1.5a25-8.src.rpm
i386:
cec9ee628151fa5e57a8313b8d7e7d81 star-1.5a25-8.i386.rpm
41c683a0720e5cfb3c034fb4257e923c star-debuginfo-1.5a25-8.i386.rpm
ia64:
a9070af290f4e3aaee258428abbd6928 star-1.5a25-8.ia64.rpm
f0abaccb1c714fefa03c2bdd61ffbc4b star-debuginfo-1.5a25-8.ia64.rpm
x86_64:
84c057a5e76010e931ede389164aba22 star-1.5a25-8.x86_64.rpm
9f17013824a0bca695a1996d77105638 star-debuginfo-1.5a25-8.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/star-1.5a25-8.src.rpm
2a15a59bd63fc8657c8a5de1097a0e36 star-1.5a25-8.src.rpm
i386:
cec9ee628151fa5e57a8313b8d7e7d81 star-1.5a25-8.i386.rpm
41c683a0720e5cfb3c034fb4257e923c star-debuginfo-1.5a25-8.i386.rpm
ia64:
a9070af290f4e3aaee258428abbd6928 star-1.5a25-8.ia64.rpm
f0abaccb1c714fefa03c2bdd61ffbc4b star-debuginfo-1.5a25-8.ia64.rpm
x86_64:
84c057a5e76010e931ede389164aba22 star-1.5a25-8.x86_64.rpm
9f17013824a0bca695a1996d77105638 star-debuginfo-1.5a25-8.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/star-1.5a75-2.src.rpm
2d83e1f9e3e42cdca6a6db6b4c2f7dd2 star-1.5a75-2.src.rpm
i386:
b945a3cfb3c7f8239fbc613bfe445254 star-1.5a75-2.i386.rpm
a65b973b458d5fb639d1b4822b3bd83c star-debuginfo-1.5a75-2.i386.rpm
x86_64:
a0c5aedf4e2ddfe326355d9c00548446 star-1.5a75-2.x86_64.rpm
d56a3e448df202135c490d6769029c18 star-debuginfo-1.5a75-2.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/star-1.5a75-2.src.rpm
2d83e1f9e3e42cdca6a6db6b4c2f7dd2 star-1.5a75-2.src.rpm
i386:
b945a3cfb3c7f8239fbc613bfe445254 star-1.5a75-2.i386.rpm
a65b973b458d5fb639d1b4822b3bd83c star-debuginfo-1.5a75-2.i386.rpm
ia64:
b6d506554b5b39ad85bf6e58fd529e4d star-1.5a75-2.ia64.rpm
812deaa09299bb02ccf9d63581f9aa66 star-debuginfo-1.5a75-2.ia64.rpm
ppc:
3adb3aabcfb038ede187ca08445ebd72 star-1.5a75-2.ppc.rpm
b73c64c51fbf14f662d4850c72b51070 star-debuginfo-1.5a75-2.ppc.rpm
s390x:
1401caceab1df673f08fa150c852ec4c star-1.5a75-2.s390x.rpm
a684fb76d82f8e9d2be27c75d7fe9e35 star-debuginfo-1.5a75-2.s390x.rpm
x86_64:
a0c5aedf4e2ddfe326355d9c00548446 star-1.5a75-2.x86_64.rpm
d56a3e448df202135c490d6769029c18 star-debuginfo-1.5a75-2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4134
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
