CVE-2016-10173 archive-tar-minitar and minitar vulnerable to Path Traversal
Remote attackers can write to arbitrary files via directory traversal in Ruby minitar gems, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10173?
CVE-2016-10173 is a high-severity path traversal vulnerability in n/a, published on 1 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
Weakness: CWE-22
Which versions are affected by CVE-2016-10173?
4 open source packages ship an affected version, including archive-tar-minitar and minitar. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
archive-tar-minitar RubyGems | All versions | 0.5.2 |
archive-tar-minitar RubyGems | All versions | 0.5.2 |
minitar RubyGems | All versions | 0.6 |
minitar RubyGems | All versions | 0.6 |
Linux distribution packages (5)
rubygem-archive-tar-minitar SUSE:Linux Enterprise Module for Containers 12 | All versions | 0.5.2-7.3.65 |
ruby3.2-rubygem-minitar openSUSE:Tumbleweed | All versions | 0.9-1.13 |
rubygem-minitar openSUSE:Tumbleweed | All versions | 0.9-1.17 |
rubygem-minitar openSUSE:Tumbleweed | All versions | 0.9-1.19 |
rubygem-minitar openSUSE:Tumbleweed | All versions | 0.9-1.21 |
Products include Minitar Archive-Tar-Minitar, Minitar Minitar.
How do I fix CVE-2016-10173?
Upgrade archive-tar-minitar to 0.5.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-10173 being exploited?
There is no known exploitation of CVE-2016-10173 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-10173, DLA-808-1, DSA-3778-1, GHSA-h5g2-38x9-4gv3, MGASA-2017-0060, SUSE-SU-2021:0115-1 and 7 more.