CVE-2002-1216 Path traversal in n/a
Remote attackers can overwrite arbitrary files via symlink attacks in GNU tar due to disabled security checks, requiring user interaction to extract archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2002-1216?
CVE-2002-1216 is a medium-severity path traversal vulnerability in n/a, published on 21 Oct 2002. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GNU tar 1.13.19 and other versions before 1.13.25 allows remote attackers to overwrite arbitrary files via a symlink attack, as the result of a modification that effectively disabled the security check.
Which versions are affected by CVE-2002-1216?
It affects 1 product.
Products include Gnu Tar.
How do I fix CVE-2002-1216?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2002-1216 being exploited?
There is no known exploitation of CVE-2002-1216 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2002-1216, GHSA-29pg-f8vr-x2wh.