From owner-freebsd-questions Sun Feb 2 19:39:11 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 029E137B401 for ; Sun, 2 Feb 2003 19:39:10 -0800 (PST) Received: from ntl.com (pc1-glfd2-4-cust59.glfd.cable.ntl.com [81.99.187.59]) by mx1.FreeBSD.org (Postfix) with ESMTP id 11ED743F3F for ; Sun, 2 Feb 2003 19:39:03 -0800 (PST) (envelope-from william@palfreman.com) Received: from aqua.lan.palfreman.com (localhost [127.0.0.1]) by ntl.com (8.12.3/8.12.3) with ESMTP id h133eKkn071773 for ; Mon, 3 Feb 2003 03:40:20 GMT (envelope-from william@palfreman.com) Received: from localhost (william@localhost) by aqua.lan.palfreman.com (8.12.3/8.12.3/Submit) with ESMTP id h133eKm3071770 for ; Mon, 3 Feb 2003 03:40:20 GMT X-Authentication-Warning: aqua.lan.palfreman.com: william owned process doing -bs Date: Mon, 3 Feb 2003 03:40:20 +0000 (GMT) From: William Palfreman To: questions@freebsd.org Subject: Tar bug, mentioned in 4.7 UPDATING Message-ID: <20030203030500.C66893@ndhn.yna.cnyserzna.pbz> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hi. I was comparing the /usr/src/UPDATING file on RELENG_4_5, 4_6 and 4_7, and I noticed that there is a fix for a tar bug in the 4.7 pX releases, but not in 4.6.2-pX and 4.5-pX. 4.5: (also 4.6.2 p3) 20021023: p21 FreeBSD-SA-02:40.kadmind Correct kadmind buffer overflow. 4.7: 20021023: p1 FreeBSD-SA-02:40.kadmind Correct bug in the tar(1) contains_dot_dot function allowing files to be extracted outside the intended directory tree. Correct kadmind buffer overflow. Do I need to update this manually for my < 4.7 systems? I see there was a bit of discussion on the security list at the time, but I can't see much more about it. I don't see why it can be worth fixing for 4.7 and not for anything else, given how widely used the tar utility is. I don't particularly mind fixing it myself, but it seems odd that this is a critical fix in one release and a feature in others. Is anyone likely to be using this as a feature in earlier releases? Bill. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message