Connect with us
X
Categories:

Technology

350k open source repos still include the 2007 Tarfile path traversal bug

Published

on

350k open source repositories still include the 2007 Tarfile path traversal bug
Share this post:

An estimated 350,000 open source repositories are affected by a 15-year old path traversal vulnerability in Python’s tarfile module, according to security researchers.

Having “stumbled across” the unpatched issue while investigating an unrelated vulnerability, they initially thought the flaw was a new zero-day bug before realizing it actually dated back to 2007.

Originally designated a severity score of CVSS 6.8, CVE-2007-4559 allows attackers to gain code execution from the file-write “in most cases”, said Trellix researcher Kasimir Schulz in a blog post published yesterday (September 21).

Schulz explained how Trellix researchers successfully achieved this outcome against wireless protocol analyzer Universal Radio Hacker, IT infrastructure management service Polemarch, and Spyder IDE, an open-source development environment for scientific programming.

Patching marathon

In a separate Trellix blog post, Douglas McKee said 61% of a sample of around 300,000 files containing the tarfile module, which makes it possible to read and write tar archives, were vulnerable to the bug.

Trellix has created patches for around 11,000 projects and anticipates that a further 70,000 projects will receive a fix in the coming weeks.

The vulnerability arose “from two or three lines of code using unsanitized tarfile.extract() or the built-in defaults of tarfile.extractall(),” explains a third Trellix blog post by Charles McFarland. “Failure to write any safety code to sanitize the members files before calling tarfile.extract() or tarfile.extractall() results in a directory traversal vulnerability, enabling a bad actor access to the file system.”

If an attacker adds ‘..’ with the separator for the operating system (‘/’ or ‘\’) into the file name, they can escape the directory the file is supposed to be extracted into.

Just a warning

However, a Python bug thread from 2007, which has been reopened in recent days, concluded with a maintainer asserting that “tarfile.py does nothing wrong, its behaviour conforms to the pax definition and pathname resolution guidelines in POSIX. There is no known or possible practical exploit”.

RECOMMENDED  Tecno Pocket Go recognized for award-winning innovation in AR gaming

The maintainer did add a warning to the Python documentation, which remains in place, that urges developers to “never extract archives from untrusted sources without prior inspection”.

Corner cases

Trellix’s McKee acknowledged that there are legitimate use cases for preserving behavior that could be abused for malicious purposes. However, he said, “in this instance I believe the risk outweighs the reward for accommodating a few corner cases”, especially given “most” third party online tutorials seemed to “incorrectly demonstrate the insecure use of the tarfile module”.

Trellix created and open-sourced a tool to aid the research and patching process that automatically detects the vulnerability in source code by leveraging AST intermediate representation.

Called Creosote, the utility provides a means to scan closed source repositories too.

“This vulnerability is incredibly easy to exploit” and prevalent in the wild, making Python’s tarfile module “a massive supply chain issue threatening infrastructure around the world”, concluded Schulz.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

General5 hours ago

Skylar Grey – Everything I Need [LYRICS]

General5 hours ago

[Music] Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey

General5 hours ago

Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey [LYRICS]

General5 hours ago

[Music] African China – Amen

General5 hours ago

[Music] African China – Baba God

General5 hours ago

African China – Baba God [LYRICS]

General5 hours ago

Machine Gun Kelly (MGK) “Home” Feat X Ambassadors & Bebe Rexha [LYRICS]

General6 hours ago

Passenger – Let Her Go [LYRICS]

General6 hours ago

[Music] Eminem – “No Love” Feat. Lil Wayne

General6 hours ago

Eminem – “No Love” Feat. Lil Wayne [LYRICS]

Music6 hours ago

[Music] Tatiana Manaois – Buzz Kill

General6 hours ago

Tatiana Manaois – Buzz Kill [LYRICS]

General6 hours ago

James Blunt – Goodbye My Lover [LYRICS]

General6 hours ago

Major Lazer – “Particula” Feat. Nasty C , Ice Prince, Patoranking & Jidenna [LYRICS]

General6 hours ago

James Blunt – You’re Beautiful [LYRICS]

General6 hours ago

Justin Timberlake – Mirrors [LYRICS]

General6 hours ago

[Music] Darey – “Pray For Me” feat. Soweto Gospel Choir

General6 hours ago

Eminem – “Love The Way You Lie” Feat. Rihanna [LYRICS]

General6 hours ago

Goldlink ft. Miguel – Got Friends [LYRICS]

General6 hours ago

Sia – I’m Still Here [LYRICS]

General6 hours ago

Yo Gotti ft. Nicki Minaj – Rake It Up [LYRICS]

General7 hours ago

Shane McMahon – Here Comes The Money [LYRICS]

General7 hours ago

Journey – Faithfully [LYRICS]

General7 hours ago

[Music] Journey – Faithfully

General7 hours ago

Eminem – Not Afraid [LYRICS]

General7 hours ago

[Music] Journey – Don’t Stop Believin’

General7 hours ago

Journey – Don’t Stop Believin’ [LYRICS]

General7 hours ago

21 Savage – Bank Account [LYRICS]

General7 hours ago

Demi Lovato – Sober [LYRICS]

General8 hours ago

Beyonce ft. Jay-Z – Apeshit [LYRICS]

General8 hours ago

Nasty C ft. ASAP Ferg – King [LYRICS]

General8 hours ago

Lil Wayne – Uproar [LYRICS]

Ed Sheeran
Lyrics8 hours ago

Ed Sheeran – Perfect [LYRICS]

General8 hours ago

[Music] Mo’Hits All Star – Close To You

General8 hours ago

Lil Dicky ft. Chris Brown – Freaky Friday [LYRICS]

Michael Jackson
Lyrics8 hours ago

Michael Jackson – Stranger In Moscow [LYRICS]

General8 hours ago

[Music] Celine Dion – I Drove All Night

General8 hours ago

Celine Dion – I Drove All Night [LYRICS]

General8 hours ago

Tatiana Manaois – Hey Little Lady [LYRICS]

Music8 hours ago

[Music] Tatiana Manaois – Live Better

Gnash (singer)
Music4 days ago

[Music] Gnash Ft Olivia O’Brien – I Hate you, I Love you

John Legend
Music1 day ago

[INSTRUMENTAL] John Legend – All Of Me

Alan Walker
Music5 days ago

Alan Walker – Faded [INSTRUMENTAL]

21 Savage
Music2 days ago

[Video] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me

Wiz Khalifa
Music3 days ago

[Instrumental] Wiz Khalifa – See You Again ft. Charlie Puth

General7 days ago

[Music] Sapientdream – Pastlives

Salvation Ministry Choir Amen
Lyrics2 days ago

Salvation Ministry Choir – Amen [LYRICS]

General7 days ago

[Music] Don Omar – Danza Kuduro (feat. Lucenzo)

General5 days ago

[Music] The Chainsmokers – ‘Don’t Let Me Down’ Feat. Daya

General7 days ago

Ladé – Adulthood Anthem (Adulthood Na Scam) [Lyrics]

General7 days ago

[Music] Timbaland – Apologize ft. OneRepublic

Powfu (singer)
Music4 days ago

[Music] Powfu – Death Bed (Coffee for Your Head) Feat. Beabadoobee

General4 days ago

[Music] Wyclef Jean – “Sweetest Girl (Dollar Bill)” Feat. Akon, Lil Wayne, Niia

General3 days ago

[Music] Zayn Malik – Entertainer

Wiz Khalifa - See You Again ft. Charlie Puth
Music4 days ago

[Music] Wiz Khalifa – See You Again ft. Charlie Puth

Music3 days ago

[Music] Exalted Tribe (HICC) – We Dey Halla

Anna Kendrick
Music4 days ago

[Music] Anna Kendrick – Cups (Pitch Perfect’s “When I’m Gone”)

General5 hours ago

[Music] Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey

General1 day ago

[Music] John Legend – Love Me Now

Right Said Fred
Music4 days ago

[Music] Right Said Fred – Stand Up (For the Champions)

Salvation Ministries Mass Choir
Music2 days ago

[Music] Salvation Ministries Choir – Chioma Me Eh(Good God)

General10 hours ago

[Music] Celine Dion – If That’s What It Takes

Salvation Ministries Mass Choir
Lyrics2 days ago

Salvation Ministries Choir – Chioma Me Eh(Good God) [LYRICS]

General11 hours ago

[Music] P!nk – Try

General6 days ago

[Music] Shaggy – Strength Of A Woman

General2 days ago

[Music] Jaden Smith – Goku

Music3 days ago

[Music] Wiz Khalifa – See You Again (Remix) Feat Charlie Puth, Eminem, Tyga, & Chris Brown

R. Kelly
Music4 days ago

[Music] R. Kelly – World’s Greatest

General1 day ago

Magic! — Rude [LYRICS]

General7 hours ago

[Music] Journey – Don’t Stop Believin’

General6 days ago

[Music] Justin Bieber – Love Me

General2 days ago

[Music] Cardi B – Bartier Cardi ft. 21 Savage

General7 days ago

[Music] Lionel Richie – Angel

General3 days ago

[Music] Tyga ft. Offset – Taste

General11 hours ago

[Music] P!nk – “Just Give Me A Reason” Feat. Nate Ruess

General7 days ago

[Music] BIG SHAQ – Man’s Not Hot

General2 days ago

[Music] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me

General7 days ago

[Music] Shayne Ward – Breathless

General6 days ago

[Music] Post Malone – Candy Paint

General5 days ago

[Music] R Kelly – When A Woman Loves

ANE Billboard Hots



Join "ANE sabi" clique

Don't miss a thing, get ogbonge ANE latest updates to fuel your conversation daily.