CVE-2011-5325

What it actually does

The flaw permits a malicious tar archive containing symlinks to cause extraction to write files outside the intended target directory by following those symlinks during unpacking.

Why it matters to the business

Attackers can overwrite or place arbitrary files on systems that extract untrusted archives with the vulnerable tar implementation, leading to configuration tampering, data corruption, or potential system compromise; the issue affects widely used embedded and Linux distributions with high ecosystem prevalence.

How an attack unfolds

An attacker crafts a tar archive embedding symlinks that traverse outside the extraction root, then delivers the archive to a victim system running vulnerable BusyBox tar; when the victim extracts the archive the symlinks cause files to be written to unauthorized locations, potentially overwriting critical system files or planting malicious content.

How to fix it

Upgrade BusyBox to version 1.22.0 v5 or later on all affected systems; rebuild or replace embedded BusyBox instances in firmware and distributions; verify extraction of untrusted archives occurs only inside isolated directories with least-privilege accounts.

How to confirm the fix worked

Confirm BusyBox version is 1.22.0 v5 or newer via binary version string or package manager output; test extraction of a known symlink tarball in a controlled directory and verify no files appear outside the target path.

Typical attack path

1. Craft malicious tar archive with crafted symlinks pointing outside extraction directory
2. Deliver archive to target via download, email attachment, or supply-chain vector
3. Victim invokes vulnerable BusyBox tar to extract the archive
4. Symlinks cause writes to arbitrary filesystem locations outside intended directory
5. Attacker achieves file overwrite or placement leading to further compromise

How to detect it

Search system and application logs for tar extraction events that reference unexpected paths or symlink creation; inspect file-system timestamps for files written outside normal extraction directories during archive operations; review process execution history for invocations of vulnerable BusyBox tar on untrusted inputs.

What your security team should do

• Immediately inventory all BusyBox deployments and prioritize upgrade of internet-facing or multi-tenant systems
• Implement archive extraction inside chroot or containerized sandboxes pending patches
• Add monitoring for unexpected file writes during tar operations in critical paths
• Review supply-chain and firmware update processes for embedded BusyBox instances