[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAN1eSkue9p8=qkJdEFrczVwc1nfUhG7w6Z2dMHhxHc47T+sv=A@mail.gmail.com>
Date: Sun, 26 May 2024 19:40:53 +0800
From: houjingyi <houjingyi647@...il.com>
To: oss-security@...ts.openwall.com
Subject: path traversal in tar extract in intel cve-bin-tool
https://github.com/intel/cve-bin-tool
>From github about page: The CVE Binary Tool helps you determine if your
system includes known vulnerabilities. You can scan binaries for over 200
common, vulnerable components (openssl, libpng, libxml2, expat and others),
or if you know the components used, you can get a list of known
vulnerabilities associated with an SBOM or a list of components and
versions.
Vuln detail: When you scan some archive with cve-bin-tool, cve-bin-tool
will try to unarchive them. The problem is for tar file, python do not
check filename in tar contains slash and backslash, so we can provide a
malicious tar file and when cve-bin-tool scan it, we can create Arbitrary
file. This is very very dangerous.
on a linux/macos machine, running cve-bin-tool against
https://github.com/snyk/zip-slip-vulnerability/blob/master/archives/zip-slip.tar
.
Then you can find /tmp/evil.txt in your machine.
on a windows machine, running cve-bin-tool against
https://github.com/snyk/zip-slip-vulnerability/blob/master/archives/zip-slip-win.tar
.
Then you can find C:\Temp\evil.txt in your machine.
Timeline:
2024/1/25 : report to intel by intigriti
2024/1/25 : intel said: we were able to reproduce your finding and have
validated your submission
2024/3/1 : intel said : Open-source projects fall out of Scope for bounty
rewards. However, we are pleased to inform you that the issue you've
reported is eligible for CVE.
2024/5/15 : intel said : this not to be an Intel product vulnerability but
a functional weakness due to Python's tar parser. As such, it does not meet
the requirements for issuing a CVE in our Bug Bounty program.
However, they fixed this in
https://github.com/intel/cve-bin-tool/releases/tag/v3.3. It's fine if you
are using latest version.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
