FreeBSD ports tree (read-only mirror)
KDE Project Security Advisory
=============================
Title: Ark: maliciously crafted TAR archive with symlinks can install files outside the extraction directory.
Risk Rating: Important
CVE: CVE-2020-24654
Versions: ark <= 20.08.0
Author: Elvis Angelaccio <elvis.angelaccio@kde.org>
Date: 27 August 2020
Overview
========
A maliciously crafted TAR archive containing symlink entries
would install files anywhere in the user's home directory upon extraction.
Proof of concept
================
For testing, an example of malicious archive can be found at
https://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.tar
Impact
======
Users can unwillingly install files like a modified .bashrc, or a malicious
script placed in ~/.config/autostart.
Workaround
==========
Before extracting a downloaded archive using the Ark GUI, users should inspect it
to make sure it doesn't contain symlink entries pointing outside the extraction folder.
The 'Extract' context menu from the Dolphin file manager shouldn't be used.
Solution
========
Ark 20.08.1 skips maliciously crafted symlinks when extracting TAR archives.
Alternatively,
|
||
---|---|---|
accessibility | ||
arabic | ||
archivers | ||
astro | ||
audio | ||
base | ||
benchmarks | ||
biology | ||
cad | ||
chinese | ||
comms | ||
converters | ||
databases | ||
deskutils | ||
devel | ||
dns | ||
editors | ||
emulators | ||
finance | ||
french | ||
ftp | ||
games | ||
german | ||
graphics | ||
hebrew | ||
hungarian | ||
irc | ||
japanese | ||
java | ||
Keywords | ||
korean | ||
lang | ||
math | ||
misc | ||
Mk | ||
multimedia | ||
net | ||
net-im | ||
net-mgmt | ||
net-p2p | ||
news | ||
polish | ||
ports-mgmt | ||
portuguese | ||
russian | ||
science | ||
security | ||
shells | ||
sysutils | ||
Templates | ||
textproc | ||
Tools | ||
ukrainian | ||
vietnamese | ||
www | ||
x11 | ||
x11-clocks | ||
x11-drivers | ||
x11-fm | ||
x11-fonts | ||
x11-servers | ||
x11-themes | ||
x11-toolkits | ||
x11-wm | ||
.arcconfig | ||
.gitattributes | ||
.gitauthors | ||
.gitignore | ||
.gitmessage | ||
CHANGES | ||
CONTRIBUTING.md | ||
COPYRIGHT | ||
GIDs | ||
LEGAL | ||
Makefile | ||
MOVED | ||
README | ||
UIDs | ||
UPDATING |
This is the FreeBSD Ports Collection. For an easy to use WEB-based interface to it, please see: https://www.FreeBSD.org/ports For general information on the Ports Collection, please see the FreeBSD Handbook ports section which is available from: https://www.FreeBSD.org/doc/en_US.ISO8859-1/books/handbook/ports.html for the latest official version or: The ports(7) manual page (man ports). These will explain how to use ports and packages. If you would like to search for a port, you can do so easily by saying (in /usr/ports): make search name="<name>" or: make search key="<keyword>" which will generate a list of all ports matching <name> or <keyword>. make search also supports wildcards, such as: make search name="gtk*" For information about contributing to FreeBSD ports, please see the Porter's Handbook, available at: https://www.FreeBSD.org/doc/en_US.ISO8859-1/books/porters-handbook/ NOTE: This tree will GROW significantly in size during normal usage! The distribution tar files can and do accumulate in /usr/ports/distfiles, and the individual ports will also use up lots of space in their work subdirectories unless you remember to "make clean" after you're done building a given port. /usr/ports/distfiles can also be periodically cleaned without ill-effect.