CVE-2006-6097 in tar
Summary
by MITRE
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/28/2026
The vulnerability described in CVE-2006-6097 represents a critical file overwrite flaw in GNU tar versions 1.15.1 and 1.16, with potential impacts extending to other versions in the affected range. This issue stems from improper handling of GNUTYPE_NAMES records within tar archives, specifically when these records contain symbolic links that are not adequately validated during the extraction process. The flaw allows maliciously crafted tar files to potentially overwrite arbitrary files on the target system, creating a significant security risk for users who extract untrusted archives.
The technical implementation of this vulnerability resides in the extract_archive function within extract.c and the extract_mangle function in mangle.c. These functions fail to properly validate symbolic link targets within GNUTYPE_NAMES records, which are used by GNU tar to store extended file attributes and names. When a tar archive contains a GNUTYPE_NAMES record with a symbolic link, the extraction process does not adequately verify whether the target path is safe or whether it would result in overwriting existing files. This improper handling creates a path traversal condition where attackers can manipulate the extraction behavior to overwrite files outside the intended extraction directory, potentially leading to privilege escalation or system compromise.
The operational impact of this vulnerability extends beyond simple file overwrites, as it can be exploited in conjunction with other attack vectors to achieve more severe consequences. Attackers can craft tar archives that appear legitimate but contain malicious symbolic links designed to overwrite critical system files, configuration files, or files owned by other users. The vulnerability is particularly dangerous because it operates at the archive extraction level, meaning that any system that processes untrusted tar files through GNU tar is potentially at risk. This includes automated build systems, package managers, and any application that relies on tar for decompression, making the attack surface quite broad.
From a cybersecurity perspective, this vulnerability aligns with CWE-22 Path Traversal and CWE-596 Overly Restrictive File Permissions, as it allows attackers to manipulate file paths during extraction. The attack pattern follows the MITRE ATT&CK framework's technique T1059 Command and Scripting Interpreter and T1566 Phishing with Social Engineering, where attackers can use compromised tar archives to deliver malicious payloads. The vulnerability also relates to T1078 Valid Accounts and T1499 Endpoint Denial of Service, as it can be used to overwrite system files or create denial of service conditions. Organizations should prioritize updating to patched versions of GNU tar, implementing proper file validation procedures, and monitoring for suspicious archive extraction activities to mitigate the risk of exploitation.