GLSA-200501-38 : Perl: rmtree and DBI tmpfile vulnerabilities

low Nessus Plugin ID 16429

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200501-38 (Perl: rmtree and DBI tmpfile vulnerabilities)

Javier Fernandez-Sanguino Pena discovered that the DBI library creates temporary files in an insecure, predictable way (CAN-2005-0077). Paul Szabo found out that 'File::Path::rmtree' is vulnerable to various race conditions (CAN-2004-0452, CAN-2005-0448).
Impact :

A local attacker could create symbolic links in the temporary files directory that point to a valid file somewhere on the filesystem. When the DBI library or File::Path::rmtree is executed, this could be used to overwrite or remove files with the rights of the user calling these functions.
Workaround :

There are no known workarounds at this time.

Solution

All Perl users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose dev-lang/perl All DBI library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose dev-perl/DBI

Plugin Details

Severity: Low

ID: 16429

File Name: gentoo_GLSA-200501-38.nasl

Version: 1.18

Type: local

Family: Gentoo Local Security Checks

Published: 2/14/2005

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:dbi, p-cpe:/a:gentoo:linux:perl, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Ease: No known exploits are available

Patch Publication Date: 1/26/2005

Vulnerability Publication Date: 12/26/2004

Reference Information

CVE: CVE-2004-0452, CVE-2005-0077, CVE-2005-0448

GLSA: 200501-38

Detections

Analytics