CVE-2013-4420 - Vulnerability Details - OpenCVE

Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00604.

Key SSVC decision points have not yet been added.

Vendors	Products
Feep	Libtar

Configuration 1 [-]

OR	cpe:2.3:a:feep:libtar::::::::
	cpe:2.3:a:feep:libtar:1.2.11:::::::*
	cpe:2.3:a:feep:libtar:1.2.13:::::::*
	cpe:2.3:a:feep:libtar:1.2.14:::::::*
	cpe:2.3:a:feep:libtar:1.2.15:::::::*
	cpe:2.3:a:feep:libtar:1.2.16:::::::*
	cpe:2.3:a:feep:libtar:1.2.17:::::::*
	cpe:2.3:a:feep:libtar:1.2.18:::::::*
	cpe:2.3:a:feep:libtar:1.2.19:::::::*

No data.

No data.

Advisories

Source	ID	Title
Debian DSA	DSA-2863-1	libtar security update
EUVD	EUVD-2013-4297	Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.debian.org/security/2014/dsa-2863
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731860
https://lists.feep.net:8080/pipermail/libtar/2014-February/000403.html
https://nvd.nist.gov/vuln/detail/CVE-2013-4420
https://www.cve.org/CVERecord?id=CVE-2013-4420

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2014-02-20T16:00:00

Updated: 2024-08-06T16:45:14.493Z

Reserved: 2013-06-12T00:00:00

Link: CVE-2013-4420

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-02-20T16:55:05.250

Modified: 2025-04-11T00:51:21.963

Link: CVE-2013-4420

Redhat

Severity : Low

Publid Date: 2013-10-01T00:00:00Z

Links: CVE-2013-4420 - Bugzilla

OpenCVE Enrichment

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:feep:libtar:*:*:*:*:*:*:*:*", "matchCriteriaId": "7908BED9-25A3-4E8B-852D-EAC8D75745C2", "versionEndIncluding": "1.2.20", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.11:*:*:*:*:*:*:*", "matchCriteriaId": "17D20697-E839-434B-A12A-6C09A8F2D79A", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.13:*:*:*:*:*:*:*", "matchCriteriaId": "FB0B7CEF-1B95-4FC5-94A6-834488341AD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.14:*:*:*:*:*:*:*", "matchCriteriaId": "15FDD28C-D035-4E76-BE44-E8191A487064", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.15:*:*:*:*:*:*:*", "matchCriteriaId": "10A64757-FC13-441A-9667-6222E1881B2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.16:*:*:*:*:*:*:*", "matchCriteriaId": "2161B141-7C5C-4FF6-B7E7-BF06580821BE", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.17:*:*:*:*:*:*:*", "matchCriteriaId": "CFEFFA4F-EF13-4CF4-AA05-CDC6DA28A383", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.18:*:*:*:*:*:*:*", "matchCriteriaId": "2E41D1E6-B7B3-4A0A-8F5A-A62BD3D6DBA8", "vulnerable": true}, {"criteria": "cpe:2.3:a:feep:libtar:1.2.19:*:*:*:*:*:*:*", "matchCriteriaId": "4EC442B5-24F9-46FA-9998-87D550AC695A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de salto de directorio en las funciones (1) tar_extract_glob y (2) tar_extract_all en libtar 1.2.20 y anteriores permiten a atacantes remotos sobreescribir archivos arbitrarios a trav\u00e9s de un .. (punto punto) en un archivo TAR manipulado."}], "id": "CVE-2013-4420", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-02-20T16:55:05.250", "references": [{"source": "secalert@redhat.com", "url": "http://www.debian.org/security/2014/dsa-2863"}, {"source": "secalert@redhat.com", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731860"}, {"source": "secalert@redhat.com", "url": "https://lists.feep.net:8080/pipermail/libtar/2014-February/000403.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2014/dsa-2863"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731860"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.feep.net:8080/pipermail/libtar/2014-February/000403.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}