Critical Vulnerability in tar-rs Affects Cargo Package Handling

Severity: High (Score: 70.5)

Sources: Ubuntu

Summary

A vulnerability was discovered in tar-rs, embedded in cargo-c, which mishandles symlinks when unpacking tar archives. This flaw allows remote attackers to exploit specially crafted tar archives, potentially modifying permissions of directories outside the extraction root and escalating privileges. The issue affects users of the cargo package manager, particularly those who may process untrusted tar archives. A standard system update is recommended to mitigate the risk. The vulnerability has been assigned a CVE identifier, but specific details such as CVE number were not provided in the articles. The articles emphasize the importance of updating systems to the latest package versions to ensure security. Ubuntu Pro users benefit from extended security coverage for numerous packages. The issue is critical due to the potential for privilege escalation and unauthorized access. Key Points: • A vulnerability in tar-rs allows privilege escalation via crafted tar archives. • Users of the cargo package manager are particularly at risk. • Immediate system updates are recommended to mitigate the vulnerability.

Key Entities

• Zero-day Exploit (attack_type)
• T1068 - Exploitation for Privilege Escalation (mitre_attack)