CVE-2016-6321

What it actually does

The safer_name_suffix function in GNU tar fails to properly sanitize the file_name parameter, allowing directory traversal sequences to bypass intended extraction protections and write files to arbitrary locations on the filesystem.

Why it matters to the business

Attackers can overwrite critical configuration, binary, or data files on systems that extract untrusted archives, leading to system compromise, data corruption, or service disruption; as tar is a foundational tool with broad ecosystem use, exposure affects many downstream applications and environments.

How an attack unfolds

An attacker creates a specially crafted tar archive containing a filename with traversal elements that evade the sanitization logic; the archive is delivered to a target system (via download, email, or supply chain); when extracted with a vulnerable tar version, files are written outside the intended directory, enabling arbitrary file writes that can be leveraged for further access or persistence.

How to fix it

Upgrade GNU tar to a fixed release containing the safer_name_suffix correction (post-1.29, including the referenced commit 7340f67b9860ea0531c1450e5aa261c50f67165d or equivalent); rebuild or replace affected packages such as eks-distro-coredns-1.9 with patched versions; avoid extracting untrusted archives until updated.

How to confirm the fix worked

Verify installed tar version is newer than 1.29 or contains the safer_name_suffix fix; test extraction of known traversal archives in a controlled environment to confirm writes are contained; review build logs or package manifests for the applied commit.

Typical attack path

1. Craft malicious tar archive embedding traversal in file_name
2. Deliver archive to target via network or supply chain
3. Induce extraction on vulnerable GNU tar (1.14-1.29)
4. Bypass sanitization and achieve arbitrary file write
5. Leverage written files for code execution or persistence

How to detect it

Review system and application logs for tar extraction events involving archives with suspicious filenames containing dot-dot sequences; correlate with unexpected file modifications outside expected directories; examine process execution of tar during file writes.

What your security team should do

• Prioritize patching all GNU tar instances to fixed versions within 30 days given public exploit availability
• Inventory systems and containers using tar for archive handling
• Implement archive extraction sandboxing or validation wrappers until patches are applied
• Monitor EPSS trend and update threat models for path traversal vectors