Red Hat Product Errata RHSA-2006:0749 - Security Advisory
Issued:
2006-12-19
Updated:
2006-12-19

RHSA-2006:0749 - Security Advisory

Synopsis

Moderate: tar security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated tar packages that fix a path traversal flaw are now available.

This update has been rated as having moderate security impact by the Red Hat
Security Response Team.

Description

The GNU tar program saves many files together in one archive and can
restore individual files (or all of the files) from that archive.

Teemu Salmela discovered a path traversal flaw in the way GNU tar extracted
archives. A malicious user could create a tar archive that could write to
arbitrary files to which the user running GNU tar has write access.
(CVE-2006-6097)

Users of tar should upgrade to this updated package, which contains a
replacement backported patch to correct this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server 2 ia64
  • Red Hat Enterprise Linux Server 2 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Workstation 2 ia64
  • Red Hat Enterprise Linux Workstation 2 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

  • BZ - 216937 - CVE-2006-6097 GNU tar directory traversal

Red Hat Enterprise Linux Server 4

SRPM
x86_64
tar-1.14-12.RHEL4.x86_64.rpm SHA-256: f57070e61034822f1b81b20611941b97c63c62d29ec05ec06b21b7cd8aea93a3
tar-1.14-12.RHEL4.x86_64.rpm SHA-256: f57070e61034822f1b81b20611941b97c63c62d29ec05ec06b21b7cd8aea93a3
ia64
tar-1.14-12.RHEL4.ia64.rpm SHA-256: ace226f3327c45a382acf5a9eb8111a4ccc72804d4101d9092a111ca74ab1ca9
tar-1.14-12.RHEL4.ia64.rpm SHA-256: ace226f3327c45a382acf5a9eb8111a4ccc72804d4101d9092a111ca74ab1ca9
i386
tar-1.14-12.RHEL4.i386.rpm SHA-256: 2a1306d0dace77ea1d0c92a1793fef616893dc03ca5659726642bda7c6793626
tar-1.14-12.RHEL4.i386.rpm SHA-256: 2a1306d0dace77ea1d0c92a1793fef616893dc03ca5659726642bda7c6793626

Red Hat Enterprise Linux Server 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Server 2

SRPM
ia64
i386

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
tar-1.14-12.RHEL4.x86_64.rpm SHA-256: f57070e61034822f1b81b20611941b97c63c62d29ec05ec06b21b7cd8aea93a3
ia64
tar-1.14-12.RHEL4.ia64.rpm SHA-256: ace226f3327c45a382acf5a9eb8111a4ccc72804d4101d9092a111ca74ab1ca9
i386
tar-1.14-12.RHEL4.i386.rpm SHA-256: 2a1306d0dace77ea1d0c92a1793fef616893dc03ca5659726642bda7c6793626

Red Hat Enterprise Linux Workstation 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 2

SRPM
ia64
i386

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
tar-1.14-12.RHEL4.x86_64.rpm SHA-256: f57070e61034822f1b81b20611941b97c63c62d29ec05ec06b21b7cd8aea93a3
i386
tar-1.14-12.RHEL4.i386.rpm SHA-256: 2a1306d0dace77ea1d0c92a1793fef616893dc03ca5659726642bda7c6793626

Red Hat Enterprise Linux Desktop 3

SRPM
x86_64
i386

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
tar-1.14-12.RHEL4.s390x.rpm SHA-256: a30b299832594b026b35c9d2a9b7c91f061657a32c1ff32f4cf96e72bc84f4f2
s390
tar-1.14-12.RHEL4.s390.rpm SHA-256: 14e9d2b52144e2a29dd0c834e4ed1cab5fb68bcfc9dffbcd83fa0909dd0dc2cc

Red Hat Enterprise Linux for IBM z Systems 3

SRPM
s390x
s390

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
tar-1.14-12.RHEL4.ppc.rpm SHA-256: 1d58ad95978a436ad242034f220291f39d097494d83b6cfa124b566084a34980

Red Hat Enterprise Linux for Power, big endian 3

SRPM
ppc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.