The DBI library (libdbi-perl) for Perl allows local users to overwrite arbitrary files via a symlink attack on a temporary PID file.

This update fixes insecure temp. file handling. (CVE-2005-0077)

Javier Fernandez-Sanguino Pena reports :

The DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered that the module DBI::ProxyServer in Perl's DBI library created a PID file in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking a program using this module (like 'dbiproxy').

Now the module does not create a such a PID file by default.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:072 advisory.

  - security flaw (CVE-2005-0077)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200501-38 (Perl: rmtree and DBI tmpfile vulnerabilities)

    Javier Fernandez-Sanguino Pena discovered that the DBI library creates     temporary files in an insecure, predictable way (CAN-2005-0077). Paul     Szabo found out that 'File::Path::rmtree' is vulnerable to various race     conditions (CAN-2004-0452, CAN-2005-0448).
  Impact :

    A local attacker could create symbolic links in the temporary files     directory that point to a valid file somewhere on the filesystem. When     the DBI library or File::Path::rmtree is executed, this could be used     to overwrite or remove files with the rights of the user calling these     functions.
  Workaround :

    There are no known workarounds at this time.

Javier Fernandez-Sanguino Pena disovered the perl5 DBI library created a temporary PID file in an insecure manner, which could be exploited by a malicious user to overwrite arbitrary files owned by the user executing the parts of the library.

The updated packages have been patched to prevent these problems.

An updated perl-DBI package that fixes a temporary file flaw in DBI::ProxyServer is now available.

DBI is a database access Application Programming Interface (API) for the Perl programming language.

The Debian Security Audit Project discovered that the DBI library creates a temporary PID file in an insecure manner. A local user could overwrite or create files as a different user who happens to run an application which uses DBI::ProxyServer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0077 to this issue.

Users should update to this erratum package which disables the temporary PID file unless configured.

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered that the DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.

ID	Name	Product	Family	Severity
41346	SuSE9 Security Update : perl-DBI (YOU Patch Number 9838)	Nessus	SuSE Local Security Checks	low
21470	FreeBSD : p5-DBI -- insecure temporary file creation vulnerability (8cfb6f42-d2b0-11da-a672-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	low
20691	Ubuntu 4.10 : libdbi-perl vulnerabilities (USN-70-1)	Nessus	Ubuntu Local Security Checks	low
17180	RHEL 4 : perl-DBI (RHSA-2005:072)	Nessus	Red Hat Local Security Checks	medium
16429	GLSA-200501-38 : Perl: rmtree and DBI tmpfile vulnerabilities	Nessus	Gentoo Local Security Checks	low
16359	Mandrake Linux Security Advisory : perl-DBI (MDKSA-2005:030)	Nessus	Mandriva Local Security Checks	low
16298	RHEL 2.1 / 3 : perl (RHSA-2005:069)	Nessus	Red Hat Local Security Checks	low
16249	Debian DSA-658-1 : libdbi-perl - insecure temporary file	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2005-0077

medium

Tenable Plugins

low

low

low

medium

low

low

low

low