The PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to create arbitrary files via the PERLIO_DEBUG variable.

Updated Perl packages that fix security a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

Kevin Finisterre discovered a flaw in sperl, the Perl setuid wrapper, which can cause debugging information to be logged to arbitrary files.
By setting an environment variable, a local user could cause sperl to create, as root, files with arbitrary filenames, or append the debugging information to existing files. (CVE-2005-0155)

A fix for this issue was first included in the update RHSA-2005:103 released in February 2005. However the patch to correct this issue was dropped from the update RHSA-2005:674 made in October 2005. This regression has been assigned CVE-2006-3813.

Users of Perl are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Two exploitable vulnerabilities involving setuid-enabled perl scripts have been discovered. The package 'perl-suid' provides a wrapper around perl which allows to use setuid-root perl scripts, i.e.
user-callable Perl scripts which have full root privileges.

Previous versions allowed users to overwrite arbitrary files by setting the PERLIO_DEBUG environment variable and calling an arbitrary setuid-root perl script. The file that PERLIO_DEBUG points to was then overwritten by Perl debug messages. This did not allow precise control over the file content, but could destroy important data. PERLIO_DEBUG is now ignored for setuid scripts. (CAN-2005-0155)

In addition, calling a setuid-root perl script with a very long path caused a buffer overflow if PERLIO_DEBUG was set. This buffer overflow could be exploited to execute arbitrary files with full root privileges. (CAN-2005-0156).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kevin Finisterre discovered bugs in perl's I/O debug support :

- The environmental variable PERLIO_DEBUG is honored even by the set-user-ID perl command (usually named sperl or suidperl). As a result, a local attacker may be able to gain elevated privileges.
(CVE-2005-0155)

- A buffer overflow may occur in threaded versions of perl when the full pathname of the script being executed is very long.
(CVE-2005-0156).

Note: By default, no set-user-ID perl binary is installed. An administrator must enable it manually at build time with the ENABLE_SUIDPERL port flag.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:103 advisory.

    Perl is a high-level programming language commonly used for system     administration utilities and Web programming.

    Kevin Finisterre discovered a stack based buffer overflow flaw in sperl,     the Perl setuid wrapper. A local user could create a sperl executable     script with a carefully created path name, overflowing the buffer and     leading to root privilege escalation.  The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0156 to     this issue.

    Kevin Finisterre discovered a flaw in sperl which can cause debugging     information to be logged to arbitrary files.  By setting an environment     variable, a local user could cause sperl to create, as root, files with     arbitrary filenames, or append the debugging information to existing files.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0155 to this issue.

    An unsafe file permission bug was discovered in the rmtree() function in     the File::Path module.  The rmtree() function removes files and directories     in an insecure manner, which could allow a local user to read or delete     arbitrary files. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2004-0452 to this issue.

    Users of Perl are advised to upgrade to this updated package, which     contains backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200502-13 (Perl: Vulnerabilities in perl-suid wrapper)

    perl-suid scripts honor the PERLIO_DEBUG environment variable and     write to that file with elevated privileges (CAN-2005-0155).
    Furthermore, calling a perl-suid script with a very long path while     PERLIO_DEBUG is set could trigger a buffer overflow (CAN-2005-0156).
  Impact :

    A local attacker could set the PERLIO_DEBUG environment variable     and call existing perl-suid scripts, resulting in file overwriting and     potentially the execution of arbitrary code with root privileges.
  Workaround :

    You are not vulnerable if you do not have the perlsuid USE flag     set or do not use perl-suid scripts.

Updated Perl packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

Kevin Finisterre discovered a stack based buffer overflow flaw in sperl, the Perl setuid wrapper. A local user could create a sperl executable script with a carefully created path name, overflowing the buffer and leading to root privilege escalation. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0156 to this issue.

Kevin Finisterre discovered a flaw in sperl which can cause debugging information to be logged to arbitrary files. By setting an environment variable, a local user could cause sperl to create, as root, files with arbitrary filenames, or append the debugging information to existing files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0155 to this issue.

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Jeroen van Wolffelaar discovered that the rmtree() function in the perl File::Path module would remove directories in an insecure manner which could lead to the removal of arbitrary files and directories via a symlink attack (CVE-2004-0452).

Trustix developers discovered several insecure uses of temporary files in many modules which could allow a local attacker to overwrite files via symlink attacks (CVE-2004-0976).

'KF' discovered two vulnerabilities involving setuid-enabled perl scripts. By setting the PERLIO_DEBUG environment variable and calling an arbitrary setuid-root perl script, an attacker could overwrite arbitrary files with perl debug messages (CVE-2005-0155). As well, calling a setuid-root perl script with a very long path would cause a buffer overflow if PERLIO_DEBUG was set, which could be exploited to execute arbitrary files with root privileges (CVE-2005-0156).

The provided packages have been patched to resolve these problems.

ID	Name	Product	Family	Severity
22278	CentOS 4 : perl (CESA-2006:0605)	Nessus	CentOS Local Security Checks	medium
22223	RHEL 4 : perl (RHSA-2006:0605)	Nessus	Red Hat Local Security Checks	medium
20693	Ubuntu 4.10 : perl vulnerabilities (USN-72-1)	Nessus	Ubuntu Local Security Checks	medium
19062	FreeBSD : perl -- vulnerabilities in PERLIO_DEBUG handling (a5eb760a-753c-11d9-a36f-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	medium
17187	RHEL 4 : perl (RHSA-2005:103)	Nessus	Red Hat Local Security Checks	medium
16450	GLSA-200502-13 : Perl: Vulnerabilities in perl-suid wrapper	Nessus	Gentoo Local Security Checks	medium
16361	RHEL 3 : perl (RHSA-2005:105)	Nessus	Red Hat Local Security Checks	medium
16360	Mandrake Linux Security Advisory : perl (MDKSA-2005:031)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2005-0155

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium