Описание
microtar's mtar_write_file_header() and mtar_write_dir_header() functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. Any application that calls these functions with an externally-influenced filename longer than 99 characters (e.g. when archiving user-supplied or attacker-controlled filenames) triggers a stack buffer overflow.
A flaw was found in microtar. The mtar_write_file_header() and mtar_write_dir_header()
functions copy a caller-supplied entry name into a fixed 100-byte stack buffer using
strcpy() without validating the name length. An application that archives an
attacker-controlled or externally supplied filename longer than 99 characters can
trigger a stack buffer overflow, which could lead to arbitrary code execution or
denial of service.
Отчет
This Important flaw in microtar allows a stack buffer overflow when applications process externally-influenced filenames exceeding 99 characters. Exploitation could lead to a denial of service or potentially arbitrary code execution if an application using microtar archives attacker-controlled input without proper validation. Red Hat rates this issue with User Interaction Required (UI:R). Exploitation depends on an application using microtar to archive a caller-supplied entry name longer than 99 characters. That path typically needs a user or application action that supplies the filename, rather than a fully automated remote attack with no interaction. The CNA assessment uses UI:N; Red Hat's score reflects this precondition.
Меры по смягчению последствий
No practical library-level workaround or fixed upstream release is published; all versions are reported affected. Applications that embed microtar should reject or truncate entry names to fewer than 100 bytes before calling mtar_write_file_header() / mtar_write_dir_header(), or replace microtar with a maintained tar implementation. Until a patched microtar is available, avoid archiving untrusted or attacker-controlled filenames with this library.
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy.
microtar's mtar_write_file_header() and mtar_write_dir_header() functions (src/microtar.c) copy a caller-supplied entry name into the 100-byte `name` field of a stack-allocated mtar_header_t via strcpy(h.name, name), with no check that strlen(name) is less than 100 before the copy. Any application that calls these functions with an externally-influenced filename longer than 99 characters (e.g. when archiving user-supplied or attacker-controlled filenames) triggers a stack buffer overflow.
EPSS
8.8 High
CVSS3