#474 ar(1) directory traversal

[Alexander Cherepanov]

ar(1) has a directory traversal vulnerability -- it seems not to check extracted filenames at all:

:::text
$ printf '!<arch>\n%-48s%-10s`\n%-48s%-10s`\n' /tmp/file 0 ../file 0 > test.a
$ ./ar -xv test.a
x - /tmp/file
x - ../file

It's usually agreed that unpackers and similar tools should not by default touch files outside the working directory. The danger is in overwriting sensitive files by an unconscious user or by an automatic process. Both absolute and relative paths are dangerous.

For similar examples please see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4131 (tar), https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4651 (patch). And I recently reported the same problem in binutils: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8737 .

[Ed Maste]

Fix in my elftoolchain repo here: https://github.com/emaste/elftoolchain/commit/57c622d5ce8bb420bee8f10824c07ad0572e66ec

Review for FreeBSD: https://reviews.freebsd.org/D1524

[Ed Maste]

Fixed in [r3169]