Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

SunOS 5.10_x86: perl format string patch.
Date this patch was last updated by Sun : Feb/23/06

SunOS 5.10: perl patch.
Date this patch was last updated by Sun : Feb/27/06

Jack Louis discovered an integer overflow in Perl, Larry Wall's Practical Extraction and Report Language, that allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via specially crafted content that is passed to vulnerable format strings of third-party software.

The old stable distribution (woody) does not seem to be affected by this problem.

Updated Perl packages that fix security issues and bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

An integer overflow bug was found in Perl's format string processor.
It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script which passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue.

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues as well as fixes for several bugs.

Updated Perl packages that fix security issues and bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

An integer overflow bug was found in Perl's format string processor.
It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script wich passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue.

Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module removed directory trees. If a local user has write permissions to a subdirectory within the tree being removed by File::Path::rmtree, it is possible for them to create setuid binary files. (CVE-2005-0448)

Solar Designer discovered several temporary file bugs in various Perl modules. A local attacker could overwrite or create files as the user running a Perl script that uses a vulnerable module. (CVE-2004-0976)

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues as well as fixes for several bugs.

The Perl Development page reports :

Dyad Security recently released a security advisory explaining how in certain cases, a carefully crafted format string passed to sprintf can cause a buffer overflow. This buffer overflow can then be used by an attacker to execute code on the machine. This was discovered in the context of a design problem with the Webmin administration package that allowed a malicious user to pass unchecked data into sprintf.

USN-222-1 fixed a vulnerability in the Perl interpreter. It was discovered that the version of USN-222-1 was not sufficient to handle all possible cases of malformed input that could lead to arbitrary code execution, so another update is necessary.

Original advisory :

Jack Louis of Dyad Security discovered that Perl did not sufficiently check the explicit length argument in format strings. Specially crafted format strings with overly large length arguments led to a crash of the Perl interpreter or even to execution of arbitrary attacker-defined code with the privileges of the user running the Perl program.

However, this attack was only possible in insecure Perl programs which use variables with user-defined values in string interpolations without checking their validity.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jack Louis of Dyad Security discovered that Perl did not sufficiently check the explicit length argument in format strings. Specially crafted format strings with overly large length arguments led to a crash of the Perl interpreter or even to execution of arbitrary attacker-defined code with the privileges of the user running the Perl program.

However, this attack was only possible in insecure Perl programs which use variables with user-defined values in string interpolations without checking their validity.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jack Louis discovered a new way to exploit format string errors in the Perl programming language that could lead to the execution of arbitrary code.

The updated packages are patched to close the particular exploit vector in Perl itself, to mitigate the risk of format string programming errors, however it does not fix problems that may exist in particular pieces of software written in Perl.

The remote host is affected by the vulnerability described in GLSA-200512-01 (Perl: Format string errors can lead to code execution)

    Jack Louis discovered a new way to exploit format string errors in     Perl that could lead to the execution of arbitrary code. This is     perfomed by causing an integer wrap overflow in the efix variable     inside the function Perl_sv_vcatpvfn. The proposed fix closes that     specific exploitation vector to mitigate the risk of format string     programming errors in Perl. This fix does not remove the need to fix     such errors in Perl code.
  Impact :

    Perl applications making improper use of printf functions (or     derived functions) using untrusted data may be vulnerable to the     already-known forms of Perl format string exploits and also to the     execution of arbitrary code.
  Workaround :

    Fix all misbehaving Perl applications so that they make proper use     of the printf and derived Perl functions.

ID	Name	Product	Family	Severity
107879	Solaris 10 (x86) : 122082-01	Nessus	Solaris Local Security Checks	medium
107352	Solaris 10 (sparc) : 119985-02	Nessus	Solaris Local Security Checks	medium
22809	Debian DSA-943-1 : perl - integer overflow	Nessus	Debian Local Security Checks	medium
21974	CentOS 4 : perl (CESA-2005:880)	Nessus	CentOS Local Security Checks	medium
21877	CentOS 3 : perl (CESA-2005:881)	Nessus	CentOS Local Security Checks	medium
21504	FreeBSD : perl, webmin, usermin -- perl format string integer wrap vulnerability (bb33981a-7ac6-11da-bf72-00123f589060)	Nessus	FreeBSD Local Security Checks	high
21008	Solaris 10 (x86) : 122082-01	Nessus	Solaris Local Security Checks	medium
21006	Solaris 10 (sparc) : 119985-02	Nessus	Solaris Local Security Checks	medium
20765	Ubuntu 4.10 / 5.04 / 5.10 : perl vulnerability (USN-222-2)	Nessus	Ubuntu Local Security Checks	medium
20764	Ubuntu 4.10 / 5.04 / 5.10 : perl vulnerability (USN-222-1)	Nessus	Ubuntu Local Security Checks	medium
20456	Mandrake Linux Security Advisory : perl (MDKSA-2005:225)	Nessus	Mandriva Local Security Checks	medium
20367	RHEL 3 : perl (RHSA-2005:881)	Nessus	Red Hat Local Security Checks	medium
20366	RHEL 4 : perl (RHSA-2005:880)	Nessus	Red Hat Local Security Checks	medium
20280	GLSA-200512-01 : Perl: Format string errors can lead to code execution	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-3962

critical

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium