CVE-2016-6321 in tar
Summary
by MITRE
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2025
The CVE-2016-6321 vulnerability represents a critical directory traversal flaw in GNU tar versions 1.14 through 1.29 that fundamentally undermines the security assumptions of file extraction operations. This vulnerability specifically affects the safer_name_suffix function which is designed to prevent malicious file paths from being written to the filesystem during archive extraction. The flaw arises from inadequate sanitization of the file_name parameter, creating a pathway for remote attackers to circumvent intended protection mechanisms and write files to arbitrary locations on the target system. The vulnerability was dubbed POINTYFEATHER due to its ability to create malicious file paths that can traverse directory structures beyond the intended extraction boundaries.
The technical implementation of this vulnerability stems from how GNU tar processes filenames during extraction operations, particularly when handling special characters and path separators in archive entries. When tar encounters filenames containing sequences like "../" or similar directory traversal patterns, the safer_name_suffix function should properly sanitize these inputs to prevent writing files outside the intended extraction directory. However, the flawed implementation fails to adequately strip or reject such traversal sequences, allowing attackers to craft archive entries that, when extracted, write data to locations outside the target directory. This improper handling of path normalization creates a direct path for privilege escalation and potential system compromise when tar is used in automated or untrusted environments.
The operational impact of CVE-2016-6321 extends beyond simple file system manipulation, representing a significant threat to system integrity and confidentiality. Attackers can exploit this vulnerability to overwrite critical system files, inject malicious code into existing programs, or create backdoor access points by writing files to system directories such as /etc, /usr/bin, or other protected locations. The vulnerability is particularly dangerous in environments where tar is used to extract untrusted archives, such as web applications processing user uploads, automated deployment systems, or mail servers processing email attachments. When combined with other exploitation techniques, this vulnerability can enable attackers to achieve remote code execution on vulnerable systems, making it a prime target for advanced persistent threat actors.
Mitigation strategies for CVE-2016-6321 must address both immediate patching requirements and operational security improvements. The most effective solution involves upgrading to GNU tar version 1.30 or later, where the directory traversal protection has been properly implemented and the safer_name_suffix function now correctly sanitizes file names. Organizations should also implement strict file validation policies that reject archives containing potentially malicious path sequences, particularly when processing untrusted content. Network segmentation and privilege separation techniques can further reduce the attack surface by limiting the impact of successful exploitation attempts. Additionally, monitoring systems should be configured to detect unusual file creation patterns in system directories, and security teams should conduct regular vulnerability assessments to ensure all tar installations remain patched against similar issues. This vulnerability aligns with CWE-22 directory traversal weaknesses and can be mapped to ATT&CK technique T1059.007 for execution through command and scripting interpreters, highlighting the importance of proper input validation and privilege control in preventing unauthorized system access.