リモートの Oracle Linux 5 ホストに、ELSA-2007-0873 のアドバイザリに記載されている脆弱性の影響を受けるパッケージがインストールされています。

    [1.5a08-5]
     - ディレクトリトラバーサルの脆弱性を修正します CVE-2007-4134
     - 解決 4: rhbz#254130

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

star がアーカイブを抽出する方法にパストラバーサルの欠陥が見つかりました。悪意のあるユーザーが作成した tar アーカイブが原因で、star を実行しているユーザーが書き込みアクセス権を持っている任意のファイルに star が書き込む可能性があります。（CVE-2007-4134）

同様に、この更新で、コマンドライン引数の「-..」が Red Hat Enterprise Linux のバージョン 3 の star に追加されます。これにより、star がパス名に「/../」が含まれるファイルを抽出できます。

在 star 擷取封存的方式中發現路徑遊走瑕疵。惡意使用者可建立導致 star 寫入任意檔案的 tar 封存，而執行 star 的使用者具有該封存的寫入權限。(CVE-2007-4134)

同時，此更新也將命令行引數「-..」新增至 star 的 Red Hat Enterprise Linux 3 版本。這會允許 star 擷取在其路徑名稱中包含「/../」的檔案。

在 star 提取存档的方式中发现路径遍历缺陷。恶意用户可创建 tar 存档，该存档将导致 star 写入运行 star 的用户具有写入权限的任意文件。(CVE-2007-4134)

此更新还向 Red Hat Enterprise Linux 3 star 版添加了命令行参数“-..”。这可让 star 提取其路径名称中包含“/../”的文件。

遠端 Oracle Linux 5 主機中安裝的一個套件受到 ELSA-2007-0873 公告中提及的弱點影響。

    [1.5a08-5]
     - 修正目錄遊走弱點 CVE-2007-4134
     - 解決：rhbz#254130

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2007-0873 advisory.

    [1.5a08-5]
     - fix directory traversal vulnerability CVE-2007-4134
     - Resolves: rhbz#254130

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200710-23 (Star: Directory traversal vulnerability)

    Robert Buchholz of the Gentoo Security team discovered a directory     traversal vulnerability in the has_dotdot() function which does not     identify //.. (slash slash dot dot) sequences in file names inside tar     files.
  Impact :

    By enticing a user to extract a specially crafted tar archive, a remote     attacker could extract files to arbitrary locations outside of the     specified directory with the permissions of the user running Star.
  Workaround :

    There is no known workaround at this time.

远程 Oracle Linux 5 主机上安装的一个程序包受到 ELSA-2007-0873 公告中提及的一个漏洞影响。

    [1.5a08-5]
     - 修复目录遍历漏洞 CVE-2007-4134
     - 已解决：rhbz#254130

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

- Mon Aug 27 2007 Peter Vrabec <pvrabec at redhat.com>     1.5a84-2

    - fix segfault of data-change-warn option (#255261),       patch from dkopecek at redhat.com

  - Fri Aug 24 2007 Peter Vrabec <pvrabec at redhat.com>     1.5a84-1

    - new upstream release with CVE-2007-4134 fix

    - Sun Jun 24 2007 Peter Vrabec <pvrabec at redhat.com>       1.5a76-3

    - build star on ARM platforms (#245465)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated star package that fixes a path traversal flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Star is a tar-like archiver. It saves multiple files into a single tape or disk archive, and can restore individual files from the archive. Star includes multi-volume support, automatic archive format detection and ACL support.

A path traversal flaw was discovered in the way star extracted archives. A malicious user could create a tar archive that would cause star to write to arbitrary files to which the user running star had write access. (CVE-2007-4134)

Red Hat would like to thank Robert Buchholz for reporting this issue.

As well, this update adds the command line argument '-..' to the Red Hat Enterprise Linux 3 version of star. This allows star to extract files containing '/../' in their pathname.

Users of star should upgrade to this updated package, which contain backported patches to correct these issues.

A path traversal flaw was discovered in the way star extracted archives. A malicious user could create a tar archive that would cause star to write to arbitrary files to which the user running star had write access. (CVE-2007-4134)

As well, this update adds the command line argument '-..' to the Red Hat Enterprise Linux 3 version of star. This allows star to extract files containing '/../' in their pathname.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
67565	Oracle Linux 5Moderate/starELSA-2007-0873	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	high
60249	Scientific Linux セキュリティ更新：SL5.x、SL4.x、SL3.x i386/x86_64 の star	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
60249	Scientific Linux 安全性更新：SL5.x、SL4.x、SL3.x i386/x86_64 上的 star	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
60249	Scientific Linux 安全更新：SL5.x、SL4.x、SL3.x i386/x86_64 中的 star	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67565	Oracle Linux 5中等/ star (ELSA-2007-0873)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	high
67565	Oracle Linux 5 : Moderate: / star (ELSA-2007-0873)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	high
27555	GLSA-200710-23 : Star: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	2007/10/25	2021/1/6	medium
67565	Oracle Linux 5Moderate/ 星 (ELSA-2007-0873)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	high
27737	Fedora 7 : star-1.5a84-2.fc7 (2007-1852)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	medium
25972	CentOS 3 / 4 / 5 : star (CESA-2007:0873)	Nessus	CentOS Local Security Checks	2007/9/5	2021/1/4	medium
25988	RHEL 3 / 4 / 5 : star (RHSA-2007:0873)	Nessus	Red Hat Local Security Checks	2007/9/5	2021/1/14	medium
60249	Scientific Linux Security Update : star on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

检测

插件搜索

high

medium

medium

medium

high

high

medium

high

medium

medium

medium

medium