oss-security - vulnerabilities in busybox tar and cpio tools

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <575DB6B1-8A9A-46C6-AA2C-9D0695E1FF85@contoso.com>
Date: Wed, 23 Apr 2025 14:11:44 +0000
From: Ian Norton <Ian.Norton@...rust.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: vulnerabilities in busybox tar and cpio tools

https://bugs.busybox.net/show_bug.cgi?id=16018  (awaiting CVE)

Busybox's cpio and tar tools will print un-escaped filenames when listing and unpacking
cpio and tar files. Malicious files containing filenames with terminal escapes can be used
to mask or modify earlier or later files in the archive from anyone running busybox tar or cpio
from a terminal.

see also https://lists.busybox.net/pipermail/busybox/2024-July/090806.html

https://security-tracker.debian.org/tracker/CVE-2023-39810

A unpacking a cpio archive can escape the working directory. Due to #16018 it is possible to
mask these traversals from anyone using cpio to inspect a file before unpacking.

see also https://lists.busybox.net/pipermail/busybox/2024-July/090851.html

Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.