Can an attacker use a tarbomb to override vital parts of my system?

Question

Can an attacker use a tarbomb to override vital parts of my system?

A tarbomb, also sometimes written as tar bomb, is a tarball whose contents appear to explode into the current directory or some other existing directory containing a large number of items when untarred rather than into a new directory created by the tarball specifically for such contents.

For example can a tar contain a file that explodes to '~/.bashrc' and override the file with a custom script that will execute when an interactive shell is opened.

I read the gnutar wont allow relative paths making this attack futile. Is it enough protection? What about other formats like rar, 7z or zip?

Thanks

Answer 1

Actually, according to wikipedia and gnu.org, gnutar won't allow absolute paths and parent directory references, meaning that, no, the tar cannot overwrite files in '~bashrc' and compromise your system.

By default, (unless you add in any additional parameters), most tar unarchivers should extract the files contained in the tar archive to a folder named after the tar archive. Actually, some unarchivers will extract into the current directory, though you could avoid annoyance caused by this by "first creating a new, protective directory and then moving the tarball into it before untarring."

I would assume that if there is a folder with the same name as the tar archive, the tar archive would be extracted to a different (renamed) folder, but that would depend on the unarchiving program that you would use.

As far as other formats go, again, it depends on the unarchiver you use, but the same concept should hold.