Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being deleted, a different vulnerability than CVE-2004-0452.

The remote Solaris system is missing necessary patches to address security updates :

  - Race condition in the rmtree function in the File::Path     module in Perl 5.6.1 and 5.8.4 sets read/write     permissions for the world, which allows local users to     delete arbitrary files and directories, and possibly     read files and directories, via a symlink attack.
    (CVE-2004-0452)

  - Buffer overflow in the PerlIO implementation in Perl     5.8.0, when installed with setuid support (sperl),     allows local users to execute arbitrary code by setting     the PERLIO_DEBUG variable and executing a Perl script     whose full pathname contains a long directory tree.
    (CVE-2005-0156)

  - Race condition in the rmtree function in File::Path.pm     in Perl before 5.8.4 allows local users to create     arbitrary setuid binaries in the tree being deleted, a     different vulnerability than CVE-2004-0452.
    (CVE-2005-0448)

  - Untrusted search path vulnerability in Perl before     5.8.7-r1 on Gentoo Linux allows local users in the     portage group to gain privileges via a malicious shared     object in the Portage temporary build directory, which     is part of the RUNPATH. (CVE-2005-4278)

  - Integer overflow in the regular expression engine in     Perl 5.8.x allows context-dependent attackers to cause a     denial of service (stack consumption and application     crash) by matching a crafted regular expression against     a long string. (CVE-2010-1158)

  - Off-by-one error in the decode_xs function in     Unicode/Unicode.xs in the Encode module before 2.44, as     used in Perl before 5.15.6, might allow     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Unicode string, which     triggers a heap-based buffer overflow. (CVE-2011-2939)

  - CGI.pm module before 3.63 for Perl does not properly     escape newlines in (1) Set-Cookie or (2) P3P headers,     which might allow remote attackers to inject arbitrary     headers into responses from applications that use     CGI.pm. (CVE-2012-5526)

Updated Perl packages that fix security issues and contain several bug fixes are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module removed directory trees. If a local user has write permissions to a subdirectory within the tree being removed by File::Path::rmtree, it is possible for them to create setuid binary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0448 to this issue.

This update also addresses the following issues :

-- Perl interpreter caused a segmentation fault when environment changes occurred during runtime.

-- Code in lib/FindBin contained a regression that caused problems with MRTG software package.

-- Perl incorrectly declared it provides an FCGI interface where it in fact did not.

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Secunia reports :

Paul Szabo has reported a vulnerability in Perl File::Path::rmtree, which potentially can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a race condition in the way File::Path::rmtree handles directory permissions when cleaning up directories. This can be exploited by replacing an existing sub directory in the directory tree with a symbolic link to an arbitrary file.

Successful exploitation may allow changing permissions of arbitrary files, if root uses an application using the vulnerable code to delete files in a directory having a world-writable sub directory.

Jan Lieskovsky reports :

perl-File-Path rmtree race condition (CVE-2005-0448 was assigned to address this)

This vulnerability was fixed in 5.8.4-7 but re-introduced in 5.8.8-1.
It's also present in File::Path 2.xx, up to and including 2.07 which has only a partial fix.

Updated Perl packages that fix security issues and bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

An integer overflow bug was found in Perl's format string processor.
It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script wich passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue.

Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module removed directory trees. If a local user has write permissions to a subdirectory within the tree being removed by File::Path::rmtree, it is possible for them to create setuid binary files. (CVE-2005-0448)

Solar Designer discovered several temporary file bugs in various Perl modules. A local attacker could overwrite or create files as the user running a Perl script that uses a vulnerable module. (CVE-2004-0976)

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues as well as fixes for several bugs.

Paul Szabo discovered another vulnerability in the rmtree() function in File::Path.pm. While a process running as root (or another user) was busy deleting a directory tree, a different user could exploit a race condition to create setuid binaries in this directory tree, provided that he already had write permissions in any subdirectory of that tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paul Szabo discovered another vulnerability in the rmtree() function in File::Path.pm. While a process running as root (or another user) was busy deleting a directory tree, a different user could exploit a race condition to create setuid binaries in this directory tree, provided that he already had write permissions in any subdirectory of that tree.

The provided packages have been patched to resolve this problem.

Paul Szabo discovered another vulnerability in the File::Path::rmtree function of perl, the popular scripting language. When a process is deleting a directory tree, a different user could exploit a race condition to create setuid binaries in this directory tree, provided that he already had write permissions in any subdirectory of that tree.

The remote host is affected by the vulnerability described in GLSA-200501-38 (Perl: rmtree and DBI tmpfile vulnerabilities)

    Javier Fernandez-Sanguino Pena discovered that the DBI library creates     temporary files in an insecure, predictable way (CAN-2005-0077). Paul     Szabo found out that 'File::Path::rmtree' is vulnerable to various race     conditions (CAN-2004-0452, CAN-2005-0448).
  Impact :

    A local attacker could create symbolic links in the temporary files     directory that point to a valid file somewhere on the filesystem. When     the DBI library or File::Path::rmtree is executed, this could be used     to overwrite or remove files with the rights of the user calling these     functions.
  Workaround :

    There are no known workarounds at this time.

ID	Name	Product	Family	Severity
80731	Oracle Solaris Third-Party Patch Update : perl-58 (cve_2012_5526_configuration_vulnerability1)	Nessus	Solaris Local Security Checks	high
67031	CentOS 4 : perl (CESA-2005:674)	Nessus	CentOS Local Security Checks	low
35582	FreeBSD : perl -- Directory Permissions Race Condition (4a99d61c-f23a-11dd-9f55-0030843d3802)	Nessus	FreeBSD Local Security Checks	low
35289	FreeBSD : p5-File-Path -- rmtree allows creation of setuid files (13b0c8c8-bee0-11dd-a708-001fc66e7203)	Nessus	FreeBSD Local Security Checks	low
21877	CentOS 3 : perl (CESA-2005:881)	Nessus	CentOS Local Security Checks	medium
20720	Ubuntu 4.10 : perl vulnerability (USN-94-1)	Nessus	Ubuntu Local Security Checks	low
20367	RHEL 3 : perl (RHSA-2005:881)	Nessus	Red Hat Local Security Checks	medium
19992	RHEL 4 : perl (RHSA-2005:674)	Nessus	Red Hat Local Security Checks	low
18172	Mandrake Linux Security Advisory : perl (MDKSA-2005:079)	Nessus	Mandriva Local Security Checks	low
17600	Debian DSA-696-1 : perl - design flaw	Nessus	Debian Local Security Checks	low
16429	GLSA-200501-38 : Perl: rmtree and DBI tmpfile vulnerabilities	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2005-0448

critical

Tenable Plugins

high

low

low

low

medium

low

medium

low

low

low

low