Several vulnerabilities have been discovered in Perl, the popular scripting language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2004-0452     Jeroen van Wolffelaar discovered that the rmtree()     function in the File::Path module removes directory     trees in an insecure manner which could lead to the     removal of arbitrary files and directories through a     symlink attack.

  - CAN-2004-0976

    Trustix developers discovered several insecure uses of     temporary files in many modules which allow a local     attacker to overwrite files via a symlink attack.

Updated Perl packages that fix security issues and bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

An integer overflow bug was found in Perl's format string processor.
It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script wich passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue.

Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module removed directory trees. If a local user has write permissions to a subdirectory within the tree being removed by File::Path::rmtree, it is possible for them to create setuid binary files. (CVE-2005-0448)

Solar Designer discovered several temporary file bugs in various Perl modules. A local attacker could overwrite or create files as the user running a Perl script that uses a vulnerable module. (CVE-2004-0976)

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues as well as fixes for several bugs.

Jeroen van Wolffelaar discovered that the rmtree() function in the perl File::Path module would remove directories in an insecure manner which could lead to the removal of arbitrary files and directories via a symlink attack (CVE-2004-0452).

Trustix developers discovered several insecure uses of temporary files in many modules which could allow a local attacker to overwrite files via symlink attacks (CVE-2004-0976).

'KF' discovered two vulnerabilities involving setuid-enabled perl scripts. By setting the PERLIO_DEBUG environment variable and calling an arbitrary setuid-root perl script, an attacker could overwrite arbitrary files with perl debug messages (CVE-2005-0155). As well, calling a setuid-root perl script with a very long path would cause a buffer overflow if PERLIO_DEBUG was set, which could be exploited to execute arbitrary files with root privileges (CVE-2005-0156).

The provided packages have been patched to resolve these problems.

The remote host is affected by the vulnerability described in GLSA-200412-04 (Perl: Insecure temporary file creation)

    Some Perl modules create temporary files in world-writable     directories with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary     files directory, pointing to a valid file somewhere on the filesystem.
    When a Perl script is executed, this would result in the file being     overwritten with the rights of the user running the utility, which     could be the root user.
  Workaround :

    There is no known workaround at this time.

Fixes security vulnerabilites: CVE-2005-3962:
http://marc.theaimsgroup.com/?l=full-disclosure&m=113342788118630&w=2 CVE-2005-3912:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912 CVE-2005-0452:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0452 CVE-2004-0976:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0976

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Recently, Trustix Secure Linux discovered some vulnerabilities in the perl package. The utility 'instmodsh', the Perl package 'PPPort.pm', and several test scripts (which are not shipped and only used during build) created temporary files in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program, or building the perl package, respectively.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
16073	Debian DSA-620-1 : perl - insecure temporary files / directories	Nessus	Debian Local Security Checks	1/2/2005	1/4/2021	low
20367	RHEL 3 : perl (RHSA-2005:881)	Nessus	Red Hat Local Security Checks	12/30/2005	1/14/2021	medium
16360	Mandrake Linux Security Advisory : perl (MDKSA-2005:031)	Nessus	Mandriva Local Security Checks	2/10/2005	1/6/2021	medium
21877	CentOS 3 : perl (CESA-2005:881)	Nessus	CentOS Local Security Checks	7/3/2006	1/4/2021	medium
15921	GLSA-200412-04 : Perl: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	12/7/2004	1/6/2021	low
20258	Fedora Core 3 : perl-5.8.5-18.FC3 (2005-1116)	Nessus	Fedora Local Security Checks	12/7/2005	1/11/2021	high
20564	Ubuntu 4.10 : perl vulnerabilities (USN-16-1)	Nessus	Ubuntu Local Security Checks	1/15/2006	1/19/2021	low

Detections

Analytics

Plugins Search

low

medium

medium

medium

low

high

low