Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - perl-Module-Signature: unsigned files interpreted as signed in some circumstances (CVE-2015-3406)

  - perl-Module-Signature: arbitrary code execution when verifying module signatures (CVE-2015-3408)

  - Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a     signature file that does not list the files. (CVE-2015-3407)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update to perl-Module-Signature 0.79 fixes the following security issues :

  - More protection of @INC from relative paths.
    (CVE-2015-3409)

  - Fix GPG signature parsing logic. (CVE-2015-3406)

  - MANIFEST.SKIP is no longer consulted unless --skip is     given. (CVE-2015-3407)

  - Properly use open() modes to avoid injection attacks.
    (CVE-2015-3408)

John Lightsey discovered multiple vulnerabilities in Module::Signature, a Perl module to manipulate CPAN SIGNATURE files.
The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2015-3406

Module::Signature could parse the unsigned portion of the SIGNATURE file as the signed portion due to incorrect handling of PGP signature boundaries.

CVE-2015-3407

Module::Signature incorrectly handled files that are not listed in the SIGNATURE file. This includes some files in the t/ directory that would execute when tests are run.

CVE-2015-3408

Module::Signature used two argument open() calls to read the files when generating checksums from the signed manifest. This allowed to embed arbitrary shell commands into the SIGNATURE file that would be executed during the signature verification process.

CVE-2015-3409

Module::Signature incorrectly handled module loading, allowing to load modules from relative paths in @INC. A remote attacker providing a malicious module could use this issue to execute arbitrary code during signature verification.

For the squeeze distribution, these issues have been fixed in version 0.63-1+squeeze2 of libmodule-signature-perl. Please note that the libtest-signature-perl package was also updated for compatibility with the CVE-2015-3407 fix.

We recommend that you upgrade your libmodule-signature-perl and libtest-signature-perl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in libmodule-signature-perl, a Perl module to manipulate CPAN SIGNATURE files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-3406     John Lightsey discovered that Module::Signature could     parse the unsigned portion of the SIGNATURE file as the     signed portion due to incorrect handling of PGP     signature boundaries.

  - CVE-2015-3407     John Lightsey discovered that Module::Signature     incorrectly handles files that are not listed in the     SIGNATURE file. This includes some files in the t/     directory that would execute when tests are run.

  - CVE-2015-3408     John Lightsey discovered that Module::Signature uses two     argument open() calls to read the files when generating     checksums from the signed manifest. This allows to embed     arbitrary shell commands into the SIGNATURE file that     would execute during the signature verification process.

  - CVE-2015-3409     John Lightsey discovered that Module::Signature     incorrectly handles module loading, allowing to load     modules from relative paths in @INC. A remote attacker     providing a malicious module could use this issue to     execute arbitrary code during signature verification.

Note that libtest-signature-perl received an update for compatibility with the fix for CVE-2015-3407 in libmodule-signature-perl.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2607-1 advisory.

    John Lightsey discovered that Module::Signature incorrectly handled PGP signature boundaries. A remote     attacker could use this issue to trick Module::Signature into parsing the unsigned portion of the     SIGNATURE file as the signed portion. (CVE-2015-3406)

    John Lightsey discovered that Module::Signature incorrectly handled files that were not listed in the     SIGNATURE file. A remote attacker could use this flaw to execute arbitrary code when tests were run.
    (CVE-2015-3407)

    John Lightsey discovered that Module::Signature incorrectly handled embedded shell commands in the     SIGNATURE file. A remote attacker could use this issue to execute arbitrary code during signature     verification. (CVE-2015-3408)

    John Lightsey discovered that Module::Signature incorrectly handled module loading. A remote attacker     could use this issue to execute arbitrary code during signature verification. (CVE-2015-3409)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated perl-Module-Signature package fixes the following security vulnerabilities reported by John Lightsey :

Module::Signature could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries.

When verifying the contents of a CPAN module, Module::Signature ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute automatically during make test

When generating checksums from the signed manifest, Module::Signature used two argument open() calls to read the files. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process.

Several modules were loaded at runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious module so that they would load from the '.' path in \@INC.

ID	Name	Product	Family	Severity
198452	RHEL 7 : perl-module-signature (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
88133	openSUSE Security Update : perl-Module-Signature (openSUSE-2016-61)	Nessus	SuSE Local Security Checks	high
84495	Debian DLA-264-1 : libmodule-signature-perl security update	Nessus	Debian Local Security Checks	high
83501	Debian DSA-3261-1 : libmodule-signature-perl - security update	Nessus	Debian Local Security Checks	high
83414	Ubuntu 14.04 LTS : Module::Signature vulnerabilities (USN-2607-1)	Nessus	Ubuntu Local Security Checks	critical
83099	Mandriva Linux Security Advisory : perl-Module-Signature (MDVSA-2015:207)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2015-3409

high

Tenable Plugins

high

high

high

high

critical

high