The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.

perl-Module-Signature was updated to 0.73, fixing bugs and security issues :

Security fix for code execution in signature checking :

  - fix for bnc#828010 (CVE-2013-2145)

  - Properly redo the previous fix using     File::Spec->file_name_is_absolute.

  - [Changes for 0.72 - Wed Jun 5 23:19:02 CST 2013]

  - Only allow loading Digest::* from absolute paths in     @INC, by ensuring they begin with \ or / characters.
    Contributed by: Florian Weimer (CVE-2013-2145)

  - [Changes for 0.71 - Tue Jun 4 18:24:10 CST 2013]

  - Constrain the user-specified digest name to /^\w+\d+$/.

  - Avoid loading Digest::* from relative paths in @INC.
    Contributed by: Florian Weimer (CVE-2013-2145)

  - [Changes for 0.70 - Thu Nov 29 01:45:54 CST 2012]

  - Don't check gpg version if gpg does not exist. This     avoids unnecessary warnings during installation when gpg     executable is not installed. Contributed by: Kenichi     Ishigaki

  - [Changes for 0.69 - Fri Nov 2 23:04:19 CST 2012]

  - Support for gpg under these alternate names: gpg gpg2     gnupg gnupg2 Contributed by: Michael Schwern

The remote host is affected by the vulnerability described in GLSA-201310-01 (Perl Module-Signature module: Arbitrary code execution)

    The &lsquo;cpansign verify&rsquo; command will automatically download keys and       use them to check the signature of CPAN packages via the SIGNATURE file.
      If an attacker were to replace this (SHA1) with a special unknown cipher       (e.g. &lsquo;Special&rsquo;) and were to include in the distribution a       &lsquo;Digest/Special.pm&rsquo;, the code in this Perl module would be executed       when &lsquo;cpansign -verify&rsquo; is run.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

This update ensures that digest modules are only loaded from absolute paths in @INC, avoiding a potential arbitrary code execution problem (CVE-2013-2145).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Florian Weimer discovered that the Module::Signature perl module incorrectly loaded unknown ciphers from relative directories. An attacker could possibly use this flaw to execute arbitrary code when a signature is verified.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated perl-Module-Signature package fixes CVE-2013-2145

Arbitrary code execution vulnerability in Module::Signature before 0.72 (CVE-2013-2145).

ID	Name	Product	Family	Severity
75080	openSUSE Security Update : perl-Module-Signature (openSUSE-SU-2013:1178-1)	Nessus	SuSE Local Security Checks	medium
70307	GLSA-201310-01 : Perl Module-Signature module: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
67282	Fedora 18 : perl-Module-Signature-0.73-1.fc18 (2013-10430)	Nessus	Fedora Local Security Checks	medium
67281	Fedora 17 : perl-Module-Signature-0.73-1.fc17 (2013-10415)	Nessus	Fedora Local Security Checks	medium
67279	Fedora 19 : perl-Module-Signature-0.73-1.fc19 (2013-10354)	Nessus	Fedora Local Security Checks	medium
67187	Ubuntu 12.04 LTS / 12.10 / 13.04 : libmodule-signature-perl vulnerability (USN-1896-1)	Nessus	Ubuntu Local Security Checks	medium
67014	Mandriva Linux Security Advisory : perl-Module-Signature (MDVSA-2013:185)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-2145

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium