CVE-2016-7162 in File Roller
Summary
by MITRE
The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2024
The vulnerability identified as CVE-2016-7162 resides within the File Roller archive utility, specifically in the _g_file_remove_directory function located in file-utils.c. This flaw affects versions ranging from 3.5.4 through 3.20.2, representing a significant security concern for users who handle untrusted archive files. The vulnerability manifests as a symlink attack that enables remote attackers to delete arbitrary files on the target system, fundamentally compromising file system integrity and potentially leading to unauthorized data destruction.
The technical implementation of this vulnerability stems from insufficient input validation and improper handling of symbolic links during archive extraction processes. When File Roller processes archive files containing symbolic links, the _g_file_remove_directory function fails to properly verify whether the target path represents a legitimate file system entry or an unsafe symbolic link. This weakness allows attackers to craft malicious archive files that contain carefully constructed symbolic links pointing to critical system files or user data. The function's lack of proper symlink resolution and validation creates a path traversal scenario where legitimate archive extraction operations inadvertently trigger file deletion commands on unintended targets.
Operationally, this vulnerability presents a severe risk to system administrators and end users who regularly process untrusted archive files. Attackers can exploit this flaw by creating malicious archives that, when extracted, cause File Roller to remove files from arbitrary locations on the file system. The attack vector is particularly dangerous because it can be executed remotely through various means such as email attachments, web downloads, or file sharing platforms. The impact extends beyond simple file deletion to potential system compromise, as attackers might target critical system files, configuration data, or user documents, leading to data loss, system instability, or further exploitation opportunities.
The vulnerability aligns with CWE-59, which classifies it as a "Improper Link Resolution Without Limiting Recursion" issue, and maps to ATT&CK technique T1059.007 for execution through archive manipulation. Organizations using File Roller in environments where untrusted archives are processed face heightened risk, particularly in scenarios involving automated file processing or user-facing applications. The flaw demonstrates a critical oversight in file system security controls, where the application fails to implement proper access controls and path validation during archive operations. Mitigation strategies should include immediate version updates to patched releases, implementation of archive scanning and validation procedures, and user education regarding the dangers of processing untrusted archive files. System administrators should also consider implementing additional security controls such as restricted user permissions for archive processing applications and monitoring for unusual file deletion patterns that might indicate exploitation attempts.