INFORMATION BULLETIN
INFORMATION BULLETIN
| PROBLEM: | A vulnerability was discovered in the rmtree function in File::Path module in Perl 5.6.1 and 5.8.4. Also vulnerabilities in multiple scripts may allow a symlink attack on temporary files. |
| PLATFORM: | Perl 5.6.1, 5.8.4 Debian GNU/Linux 3.0 (woody) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS, ES, WS (v. 4) |
| DAMAGE: | A race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, allowing local users to delete files and directories and possible read files and directories via a symlink attack. Multiple scripts in the Perl package allow local users to overwrite files via a symlink attack on temporary files. |
| SOLUTION: | Apply the available security updates. |
| VULNERABILITY ASSESSMENT: |
The risk is LOW. Symlink attacks are typically difficult to exploit. |
| LINKS: | |
| CIAC BULLETIN: | http://www.ciac.org/ciac/bulletins/p-086.shtml |
| ORIGINAL BULLETIN: | http://www.debian.org/security/2004/dsa-620 |
| ADDITIONAL LINK: | Red Hat Security Advisory RHSA-2005:103-04 https://rhn.redhat.com/errata/RHSA-2005-103.html |
| CVE/CAN: | http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CAN-2004-0452, CAN-2004-0976 |
REVISION HISTORY:
02/22/2005 - revised to add a link to Red Hat Security Advisory RHSA-2005:103-04
for Red Hat Desktop (v. 4) and Red Hat Enterprise Linux AS, ES, WS
(v. 4).
[***** Start DSA-620-1 perl -- insecure temporary files / directories *****]
Debian Security Advisory
DSA-620-1 perl -- insecure temporary files / directories
Date Reported: 30 Dec 2004
Affected Packages: perl
Vulnerable: Yes
Security database references:
In Mitre's CVE dictionary: CAN-2004-0452, CAN-2004-0976.
More information:
Several vulnerabilities have been discovered in Perl, the popular scripting language.
The Common Vulnerabilities and Exposures project identifies the following problems:
CAN-2004-0452
Jeroen van Wolffelaar discovered that the rmtree() function in the File::Path module removes
directory trees in an insecure manner which could lead to the removal of arbitrary files and
directories through a symlink attack.
CAN-2004-0976
Trustix developers discovered several insecure uses of temporary files in many modules which
allow a local attacker to overwrite files via a symlink attack.
For the stable distribution (woody) these problems have been fixed in version 5.6.1-8.8.
For the unstable distribution (sid) these problems have been fixed in version 5.8.4-5.
We recommend that you upgrade your perl packages.
Fixed in: Debian GNU/Linux 3.0 (woody)
MD5 checksums of the listed files are available in the original advisory.
[***** End DSA-620-1 perl -- insecure temporary files / directories *****]
Voice: +1 866-941-2472 (7 x 24)
E-mail: doecirc@doecirc.energy.gov
World Wide Web: http://www.doecirc.energy.gov/