High severity · published Dec 9, 2016
CVE-2016-6321
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write…
7.5
CVSS
15.7%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)15.7% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Tar · Gnu
1.14; 1.15; 1.15.1; 1.15.90; 1.15.91; 1.16; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6321
Issue Tracking
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d
Mailing List
http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html
Exploit
http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html
Mailing List
http://seclists.org/fulldisclosure/2016/Oct/102
Mailing List
http://seclists.org/fulldisclosure/2016/Oct/96
www.debian.org
http://www.debian.org/security/2016/dsa-3702
More from Tar
7.5
CVE-2019-9923
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers
6.2
CVE-2023-39804
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c
5.5
CVE-2026-5704
Tar: tar: hidden file injection via crafted archives
5.5
CVE-2022-48303
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump
4.7
CVE-2018-20482
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in…