sharutils: Directory traversal (security issue) in uudecode

--MP_/ucHxtgvkXXw2py+Vg0c.Wwp
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hello,

I want to report a security issue in the uudecode commandline tool that
is part of sharutils.

The tool is vulnerable to a classic directory traversal attack. It will
interpret file paths in the "begin" line of the uuencoded input. When
running it on untrusted input this allows creating arbitrary files on
the filesystem (e.g. replacing /etc/shadow if the root user decodes a
file).

There are two variations: Passing a path starting with a number of
../../ repetitions or directly starting with /. I have attached
simple proof of concept files for both variants.

--=20
Hanno B=C3=B6ck
https://hboeck.de/

--MP_/ucHxtgvkXXw2py+Vg0c.Wwp
Content-Type: application/octet-stream; name=trav1.uu
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=trav1.uu

YmVnaW4gNjQ0IC4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL3RtcC90ZXN0MQokODYpQyJAYGAKYApl
bmQK

--MP_/ucHxtgvkXXw2py+Vg0c.Wwp
Content-Type: application/octet-stream; name=trav2.uu
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=trav2.uu

YmVnaW4gNjQ0IC90bXAvdGVzdDIKJDg2KUMiQGBgCmAKZW5kCg==

--MP_/ucHxtgvkXXw2py+Vg0c.Wwp--