Directory traversal in `ar`

Mark Wielaard mjw at
Mon Dec 29 00:00:48 UTC 2014

On Sun, Dec 28, 2014 at 11:00:48PM +0300, Alexander Cherepanov wrote:
> >Is your example something that is actually produced by another ar
> >implementation? Or is it an example of a bad long file name that
> >we don't handle properly?
> Yes, this is a constructed example of a malicious file. An attempt to
> extract the contents of the archive will lead to creation of a file in the
> root directory. It's usually agreed that unpackers and similar tools should
> not by default touch files outside the working directory. The danger is in
> overwriting sensitive files by an unconscious user or by an automatic
> process.
> For similar examples please see
> (tar),
> (patch). And I
> recently reported the same problem in binutils:
> .
> In case of elfutils the danger is mitigated by the fact that AFAICT only one
> '/' is possible in a filename and only in the leading position. Hence only
> files in the root directory can be written with this attack and only when ar
> is executed by root.

Aha. I should have immediately guessed you were looking for something
malicious :) Thanks for the explanation. And yes, the only '/' possible
without your patch is at the start of the long name.

> >BTW. For patches we require people to follow the guidelines in the
> >CONTRIBUTING file (in particular we require a Signed-off-by line):
> >
> Sorry, a better patch attached.

The patch looks perfect and I agree with your analysis.
Pushed as is to master.



More information about the elfutils-devel mailing list