RHEL 6 : perl (RHSA-2011:0558)

Medium Nessus Plugin ID 54593

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 4.2

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated perl packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Perl CGI module provides resources for preparing and processing Common Gateway Interface (CGI) based HTTP requests and responses.

It was found that the Perl CGI module used a hard-coded value for the MIME boundary string in multipart/x-mixed-replace content. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially crafted HTTP request. (CVE-2010-2761)

A CRLF injection flaw was found in the way the Perl CGI module processed a sequence of non-whitespace preceded by newline characters in the header. A remote attacker could use this flaw to conduct an HTTP response splitting attack via a specially crafted sequence of characters provided to the CGI module. (CVE-2010-4410)

It was found that certain Perl string manipulation functions (such as uc() and lc()) failed to preserve the taint bit. A remote attacker could use this flaw to bypass the Perl taint mode protection mechanism in scripts that use the affected functions to process tainted input.
(CVE-2011-1487)

These packages upgrade the CGI module to version 3.51. Refer to the CGI module's Changes file, linked to in the References, for a full list of changes.

This update also fixes the following bugs :

* When using the 'threads' module, an attempt to send a signal to a thread that did not have a signal handler specified caused the perl interpreter to terminate unexpectedly with a segmentation fault. With this update, the 'threads' module has been updated to upstream version 1.82, which fixes this bug. As a result, sending a signal to a thread that does not have the signal handler specified no longer causes perl to crash. (BZ#626330)

* Prior to this update, the perl packages did not require the Digest::SHA module as a dependency. Consequent to this, when a user started the cpan command line interface and attempted to download a distribution from CPAN, they may have been presented with the following message :

CPAN: checksum security checks disabled because Digest::SHA not installed. Please consider installing the Digest::SHA module.

This update corrects the spec file for the perl package to require the perl-Digest-SHA package as a dependency, and cpan no longer displays the above message. (BZ#640716)

* When using the 'threads' module, continual creation and destruction of threads could cause the Perl program to consume an increasing amount of memory. With this update, the underlying source code has been corrected to free the allocated memory when a thread is destroyed, and the continual creation and destruction of threads in Perl programs no longer leads to memory leaks. (BZ#640720)

* Due to a packaging error, the perl packages did not include the 'NDBM_File' module. This update corrects this error, and 'NDBM_File' is now included as expected. (BZ#640729)

* Prior to this update, the prove(1) manual page and the 'prove
--help' command listed '--fork' as a valid command line option.
However, version 3.17 of the Test::Harness distribution removed the support for the fork-based parallel testing, and the prove utility thus no longer supports this option. This update corrects both the manual page and the output of the 'prove --help' command, so that '--fork' is no longer included in the list of available command line options. (BZ#609492)

Users of Perl, especially those of Perl threads, are advised to upgrade to these updated packages, which correct these issues.

Solution

Update the affected packages.

See Also

https://access.redhat.com/security/cve/cve-2010-2761

https://access.redhat.com/security/cve/cve-2010-4410

https://access.redhat.com/security/cve/cve-2011-1487

http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.51/Changes

https://access.redhat.com/errata/RHSA-2011:0558

Plugin Details

Severity: Medium

ID: 54593

File Name: redhat-RHSA-2011-0558.nasl

Version: 1.7

Type: local

Agent: unix

Published: 2011/05/20

Updated: 2019/10/25

Dependencies: 12634

Risk Information

Risk Factor: Medium

VPR Score: 4.2

CVSS v2.0

Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:perl, p-cpe:/a:redhat:enterprise_linux:perl-Archive-Extract, p-cpe:/a:redhat:enterprise_linux:perl-Archive-Tar, p-cpe:/a:redhat:enterprise_linux:perl-CGI, p-cpe:/a:redhat:enterprise_linux:perl-CPAN, p-cpe:/a:redhat:enterprise_linux:perl-CPANPLUS, p-cpe:/a:redhat:enterprise_linux:perl-Compress-Zlib, p-cpe:/a:redhat:enterprise_linux:perl-Digest-SHA, p-cpe:/a:redhat:enterprise_linux:perl-ExtUtils-CBuilder, p-cpe:/a:redhat:enterprise_linux:perl-ExtUtils-Embed, p-cpe:/a:redhat:enterprise_linux:perl-ExtUtils-MakeMaker, p-cpe:/a:redhat:enterprise_linux:perl-ExtUtils-ParseXS, p-cpe:/a:redhat:enterprise_linux:perl-File-Fetch, p-cpe:/a:redhat:enterprise_linux:perl-IO-Compress-Base, p-cpe:/a:redhat:enterprise_linux:perl-IO-Compress-Zlib, p-cpe:/a:redhat:enterprise_linux:perl-IO-Zlib, p-cpe:/a:redhat:enterprise_linux:perl-IPC-Cmd, p-cpe:/a:redhat:enterprise_linux:perl-Locale-Maketext-Simple, p-cpe:/a:redhat:enterprise_linux:perl-Log-Message, p-cpe:/a:redhat:enterprise_linux:perl-Log-Message-Simple, p-cpe:/a:redhat:enterprise_linux:perl-Module-Build, p-cpe:/a:redhat:enterprise_linux:perl-Module-CoreList, p-cpe:/a:redhat:enterprise_linux:perl-Module-Load, p-cpe:/a:redhat:enterprise_linux:perl-Module-Load-Conditional, p-cpe:/a:redhat:enterprise_linux:perl-Module-Loaded, p-cpe:/a:redhat:enterprise_linux:perl-Module-Pluggable, p-cpe:/a:redhat:enterprise_linux:perl-Object-Accessor, p-cpe:/a:redhat:enterprise_linux:perl-Package-Constants, p-cpe:/a:redhat:enterprise_linux:perl-Params-Check, p-cpe:/a:redhat:enterprise_linux:perl-Parse-CPAN-Meta, p-cpe:/a:redhat:enterprise_linux:perl-Pod-Escapes, p-cpe:/a:redhat:enterprise_linux:perl-Pod-Simple, p-cpe:/a:redhat:enterprise_linux:perl-Term-UI, p-cpe:/a:redhat:enterprise_linux:perl-Test-Harness, p-cpe:/a:redhat:enterprise_linux:perl-Test-Simple, p-cpe:/a:redhat:enterprise_linux:perl-Time-HiRes, p-cpe:/a:redhat:enterprise_linux:perl-Time-Piece, p-cpe:/a:redhat:enterprise_linux:perl-core, p-cpe:/a:redhat:enterprise_linux:perl-debuginfo, p-cpe:/a:redhat:enterprise_linux:perl-devel, p-cpe:/a:redhat:enterprise_linux:perl-libs, p-cpe:/a:redhat:enterprise_linux:perl-parent, p-cpe:/a:redhat:enterprise_linux:perl-suidperl, p-cpe:/a:redhat:enterprise_linux:perl-version, cpe:/o:redhat:enterprise_linux:6

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2011/05/19

Vulnerability Publication Date: 2010/12/06

Reference Information

CVE: CVE-2010-2761, CVE-2010-4410, CVE-2010-4411, CVE-2011-1487

BID: 45145, 47124

RHSA: 2011:0558