Re: [gna-private] [SECURITY] [DSA 987-1] New tar packages fix arbitrary code execution
* Steve Kemp:
> On Wed, Mar 08, 2006 at 09:41:39AM +0100, Mathieu Roy wrote:
>
>> > Package : tar
>> > Vulnerability : buffer overflow
>> > Problem-Type : local(remote)
>>
>> What does mean
>> local(remote)
>>
>> Does it means local... or remote?
>
> Local. But remote in the sense that you may receive a .tar file
> from a remote source.
NVD calls this "user-initiated". With infrastructure software like
tar, it's hard to tell how it is indirectly exposed to the network, so
the attack range classification does not make much sense (even more
difficult is zlib; tar has got at least a bit of networking support).
Reply to: