Multiple scripts in the perl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.

Updated Perl packages that fix security issues and bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

An integer overflow bug was found in Perl's format string processor.
It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script wich passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue.

Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module removed directory trees. If a local user has write permissions to a subdirectory within the tree being removed by File::Path::rmtree, it is possible for them to create setuid binary files. (CVE-2005-0448)

Solar Designer discovered several temporary file bugs in various Perl modules. A local attacker could overwrite or create files as the user running a Perl script that uses a vulnerable module. (CVE-2004-0976)

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues as well as fixes for several bugs.

Recently, Trustix Secure Linux discovered some vulnerabilities in the perl package. The utility 'instmodsh', the Perl package 'PPPort.pm', and several test scripts (which are not shipped and only used during build) created temporary files in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program, or building the perl package, respectively.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes security vulnerabilites: CVE-2005-3962:
http://marc.theaimsgroup.com/?l=full-disclosure&m=113342788118630&w=2 CVE-2005-3912:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912 CVE-2005-0452:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0452 CVE-2004-0976:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0976

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jeroen van Wolffelaar discovered that the rmtree() function in the perl File::Path module would remove directories in an insecure manner which could lead to the removal of arbitrary files and directories via a symlink attack (CVE-2004-0452).

Trustix developers discovered several insecure uses of temporary files in many modules which could allow a local attacker to overwrite files via symlink attacks (CVE-2004-0976).

'KF' discovered two vulnerabilities involving setuid-enabled perl scripts. By setting the PERLIO_DEBUG environment variable and calling an arbitrary setuid-root perl script, an attacker could overwrite arbitrary files with perl debug messages (CVE-2005-0155). As well, calling a setuid-root perl script with a very long path would cause a buffer overflow if PERLIO_DEBUG was set, which could be exploited to execute arbitrary files with root privileges (CVE-2005-0156).

The provided packages have been patched to resolve these problems.

Several vulnerabilities have been discovered in Perl, the popular scripting language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2004-0452     Jeroen van Wolffelaar discovered that the rmtree()     function in the File::Path module removes directory     trees in an insecure manner which could lead to the     removal of arbitrary files and directories through a     symlink attack.

  - CAN-2004-0976

    Trustix developers discovered several insecure uses of     temporary files in many modules which allow a local     attacker to overwrite files via a symlink attack.

The remote host is affected by the vulnerability described in GLSA-200412-04 (Perl: Insecure temporary file creation)

    Some Perl modules create temporary files in world-writable     directories with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary     files directory, pointing to a valid file somewhere on the filesystem.
    When a Perl script is executed, this would result in the file being     overwritten with the rights of the user running the utility, which     could be the root user.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
21877	CentOS 3 : perl (CESA-2005:881)	Nessus	CentOS Local Security Checks	medium
20564	Ubuntu 4.10 : perl vulnerabilities (USN-16-1)	Nessus	Ubuntu Local Security Checks	low
20367	RHEL 3 : perl (RHSA-2005:881)	Nessus	Red Hat Local Security Checks	medium
20258	Fedora Core 3 : perl-5.8.5-18.FC3 (2005-1116)	Nessus	Fedora Local Security Checks	high
16360	Mandrake Linux Security Advisory : perl (MDKSA-2005:031)	Nessus	Mandriva Local Security Checks	medium
16073	Debian DSA-620-1 : perl - insecure temporary files / directories	Nessus	Debian Local Security Checks	low
15921	GLSA-200412-04 : Perl: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2004-0976

medium

Tenable Plugins

medium

low

medium

high

medium

low

low