Cloudanix VulnDB

CVE-2016-7162

High · 7.5

CVSS

7.5

EPSS

3.3%

Published

Sep 26, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in an older file-compression program can let attackers wipe out important files on a computer when someone opens a specially prepared archive.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits deletion of arbitrary files on the host filesystem through improper path validation in archive extraction logic that fails to handle symlinks safely.

Why it matters to the business

Attackers can cause targeted data loss or service disruption by deleting critical configuration, log, or data files; the vulnerability has been public for nearly a decade with public exploits available, increasing long-term exposure for any remaining unpatched File Roller deployments on Ubuntu or similar systems.

How an attack unfolds

An attacker creates a malicious archive containing a folder entry followed by a symlink that points outside the extraction directory; when a victim opens the archive with File Roller, the extraction routine follows the symlink and removes arbitrary files instead of safely skipping or sandboxing the operation.

How to fix it

Upgrade File Roller to a version newer than 3.20.2 that contains the corrected path-handling logic; if no newer package is available for the distribution, replace the application with a maintained archive tool and restrict extraction of untrusted archives to isolated environments.

How to confirm the fix worked

Confirm the installed File Roller version is newer than 3.20.2, test extraction of a crafted symlink archive in a disposable environment to verify deletion attempts are rejected, and review package manager history for the presence of updated file-roller packages.

Typical attack path

  1. Craft a specially formed archive embedding a symlink folder entry
  2. Deliver the archive via email, download link, or shared storage
  3. Victim opens the archive using File Roller for extraction or preview
  4. The extraction routine follows the symlink and deletes arbitrary host files

How to detect it

Review system logs and file-access audit trails around the time untrusted archives were opened for unexpected deletions of configuration or data files; correlate with File Roller process execution and any archive files present in user directories.

What your security team should do

  • Immediately inventory all systems running File Roller 3.5.4-3.20.2 and schedule removal or upgrade
  • Block or sandbox use of File Roller for untrusted archives until remediation is complete
  • Add archive extraction tools to the list of high-risk applications monitored for version drift

The record

The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 file-roller 0 3.20.3-1
Debian:12 file-roller 0 3.20.3-1
Debian:13 file-roller 0 3.20.3-1
Debian:14 file-roller 0 3.20.3-1
Mageia:5 file-roller 0 3.14.2-1.1.mga5
Ubuntu:14.04:LTS file-roller 0 3.10.2.1-0ubuntu4.2
Ubuntu:16.04:LTS file-roller 0 3.16.5-0ubuntu1.2

Related vulnerabilities