Ubuntu tar Update Fixes File Extraction Regression
Ubuntu addresses tar utility regression that prevented extraction of valid files. The fix resolves issues from previous security patch.
TL;DR
- Ubuntu released USN-8477-2 to fix tar extraction regression
- Previous update caused failures with certain valid archive files
- Original vulnerability allowed hidden file injection attacks
- Organizations should update tar packages immediately
- Issue affects archive inspection and file handling workflows
Ubuntu has issued a security update to address a regression in the tar utility that was introduced in a previous patch. The issue, identified as USN-8477-2, resolves problems where tar would fail to extract certain legitimate archive files following recent security improvements.
The regression stems from efforts to fix a vulnerability that could allow attackers to inject hidden files with malicious content into archives. While the initial patch improved security by preventing bypass of pre-extraction inspection mechanisms, it inadvertently broke functionality for some valid use cases.
Vulnerability Details
- Original vulnerability allowed crafted archive files to inject hidden files with attacker-controlled content
- Attackers could bypass pre-extraction inspection mechanisms through malicious archive manipulation
- Initial fix addressed security concerns but introduced compatibility issues with legitimate archives
- Regression specifically affected tar's ability to process certain valid file extraction scenarios
Impact and Recommendations
- Organizations using Ubuntu systems should apply the USN-8477-2 update immediately
- Systems relying on automated archive processing may have experienced extraction failures
- Security teams should verify tar functionality after applying the patch
- Review archive handling processes to ensure proper file validation without breaking legitimate operations
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.