The unshar utility is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/sharutils | * | < 4.2.1-r11 | >= 4.2.1-r11 |
sharutils is a collection of tools to deal with shar archives.
Joey Hess has discovered that the program unshar, which is a part of sharutils, creates temporary files in a world-writable directory with predictable names.
A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When unshar is executed, this would result in the file being overwritten with the rights of the user running the utility, which could be the root user.
There is no known workaround at this time.
All sharutils users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/sharutils-4.2.1-r11"
sharutils contains two buffer overflow vulnerabilities that could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/sharutils | * | <= 4.2.1-r9 | >= 4.2.1-r10 |
sharutils contains utilities to manage shell archives.
sharutils contains two buffer overflows. Ulf Harnhammar discovered a buffer overflow in shar.c, where the length of data returned by the wc command is not checked. Florian Schilhabel discovered another buffer overflow in unshar.c.
An attacker could exploit these vulnerabilities to execute arbitrary code as the user running one of the sharutils programs.
There is no known workaround at this time.
All sharutils users should upgrade to the latest version:
# emerge sync # emerge -pv ">=app-arch/sharutils-4.2.1-r10" # emerge ">=app-arch/sharutils-4.2.1-r10"