GLSA-200501-38 : Perl: rmtree and DBI tmpfile vulnerabilities

Low Nessus Plugin ID 16429


The remote Gentoo host is missing one or more security-related patches.


The remote host is affected by the vulnerability described in GLSA-200501-38 (Perl: rmtree and DBI tmpfile vulnerabilities)

Javier Fernandez-Sanguino Pena discovered that the DBI library creates temporary files in an insecure, predictable way (CAN-2005-0077). Paul Szabo found out that 'File::Path::rmtree' is vulnerable to various race conditions (CAN-2004-0452, CAN-2005-0448).
Impact :

A local attacker could create symbolic links in the temporary files directory that point to a valid file somewhere on the filesystem. When the DBI library or File::Path::rmtree is executed, this could be used to overwrite or remove files with the rights of the user calling these functions.
Workaround :

There are no known workarounds at this time.


All Perl users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose dev-lang/perl All DBI library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose dev-perl/DBI

See Also

Plugin Details

Severity: Low

ID: 16429

File Name: gentoo_GLSA-200501-38.nasl

Version: $Revision: 1.15 $

Type: local

Published: 2005/02/14

Modified: 2017/08/14

Dependencies: 12634

Risk Information

Risk Factor: Low


Base Score: 2.6

Temporal Score: 2.1

Vector: CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:DBI, p-cpe:/a:gentoo:linux:perl, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2005/01/26

Vulnerability Publication Date: 2004/12/26

Reference Information

CVE: CVE-2004-0452, CVE-2005-0077, CVE-2005-0448

OSVDB: 12588, 13186

GLSA: 200501-38