- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202405-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: xar: Unsafe Extraction
Date: May 07, 2024
Bugs: #820641
ID: 202405-19

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A vulnerability has been discovered in xar, which can lead to privilege escalation.

Background
==========

xar provides an easily extensible archive format.

Affected packages
=================

Package Vulnerable Unaffected
------------ ------------------- --------------------
app-arch/xar < 1.8.0.0.487.100.1 >= 1.8.0.0.487.100.1

Description
===========

A vulnerability has been discovered in xar. Please review the CVE
identifier referenced below for details.

Impact
======

xar allows for a forward-slash separated path to be specified in the
file name property, e.g. <name>x/foo</name> – as long as it doesn’t traverse upwards, and the path exists within the current directory. This
means an attacker can create a .xar file which contains both a directory symlink, and a file with a name property which points into the extracted symlink directory. By abusing symlink directories in this manner, an
attacker can write arbitrary files to any directory on the filesystem – providing the user has permissions to write to it.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All xar users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-arch/xar-1.8.0.0.487.100.1"

References
==========

[ 1 ] CVE-2021-30833
https://nvd.nist.gov/vuln/detail/CVE-2021-30833

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202405-19

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmY5sUYACgkQFMQkOaVy +9lfPxAAmv6v8XjabSqc/HakhMVE6tZYvKpSsmiXVm2Db2jGtzd3Q75dXvHevrrq ocga+3s1Po6uVFmuM5q6viitdkBltUtTOg3O2G5D299ix/sibkM/ktzK0ZijZOpg qt5wta6vdUXB2bzAa5ZPiyRFckNRLFnBW9kiRyGwep4bVRRKpYrLNrMRwB8V/Lwr txQd+Kn78prGoZLgptAtW3XJPc6PjP2elMaL6J47cGdogV8jr/9jqktKBrOi7lap SMIm3u/YYOk2oqEjT3GNql0dmQF+QHV2nCMwrK2Y+N/3x2kv0jZh3iB3Xm57NwA1 wsEkvRR9z0f6hX2CHXF5QqEXEsGBGDglONnNYa18cpm/N9+NOpLYVHr9lU86DWuC QCjkfWDpKYqeysaSy/o8V7OYhFQnpS1oM8UE5yP2/hHy3NVVliGyKTJPBjw4ANz2 TMNtBYU8tQc3XzVId4y5IEai3udK412OwIKTIf3cLDE/5XbOMPIkhdFkGYhCnjDR jQVGjEuEu+Gnv9AKamFHHxM+e6cp9m/BYrGO95qJCPh76v24ztRBa6uIypUqFsL8 G6m4Fhyv+rf3EHPFl9YIwyr52hfePUsUt0wUF1aLLqtx3lnycK4b+zGs3KUhUF9Y X6S6SgyRoCbxBaHQeDV50SQYxnnFQBwFMqP7o7wGto/JLYyPYT8=
=//pG
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)