Description
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tar | 1.16-2 | — |
| Debian 13 | tar | 1.16-2 | — |
| Debian 12 | tar | 1.16-2 | — |
| Debian 3.1 | tar | 1.14-2.3 | DSA-1223-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | tar | 1.14-12.RHEL4 | RHSA-2006:0749 |
| RHEL 3 | tar | 1.13.25-15.RHEL3 | RHSA-2006:0749 |
| RHEL 2 | tar | 1.13.25-6.AS21.1 | RHSA-2006:0749 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tar | 1.34-2.2 | openSUSE-SU-2024:11422-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- GNU Tar 1.1x - 'GNUTYPE_NAMES' Directory Traversal EDB-29160 · remote · Nov 21, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2006:0749 Red Hat Security Advisory: tar security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1223-1 tar Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11422-1 tar-1.34-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 23117 third-party-advisory
- oval:org.mitre.oval:def:10963 vdb-entry signature
- https://issues.rpath.com/browse/RPL-821
- 1918 third-party-advisory
- TA07-072A third-party-advisory
- 21235 vdb-entry
- 23146 third-party-advisory
- 20061121 GNU tar directory traversal mailing-list
- http://kb.vmware.com/KanisaPlatform/Publishing/817/2240267_f.SAL_Public.html
- APPLE-SA-2007-03-13 vendor-advisory
- 23209 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- ADV-2006-5102 vdb-entry
- 2006-0068 vendor-advisory
- 23142 third-party-advisory
- 23314 third-party-advisory
- ADV-2007-1171 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2007-015.htm
- GLSA-200612-10 vendor-advisory
- 23198 third-party-advisory
- 23115 third-party-advisory
- http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.html
- 20061201 rPSA-2006-0222-1 tar mailing-list
- 23911 third-party-advisory
- USN-385-1 vendor-advisory
- 20070330 VMSA-2007-0002 VMware ESX security updates mailing-list
- 23173 third-party-advisory
- RHSA-2006:0749 vendor-advisory
- FreeBSD-SA-06:26 vendor-advisory
- 1017423 vdb-entry
- 24636 third-party-advisory
- DSA-1223 vendor-advisory
- ADV-2007-0930 vdb-entry
- 23443 third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216937
- MDKSA-2006:219 vendor-advisory
- OpenPKG-SA-2006.038 vendor-advisory
- ADV-2006-4717 vdb-entry
- 23514 third-party-advisory
- SSA:2006-335-01 vendor-advisory
- 24479 third-party-advisory
- 23163 third-party-advisory