Synopsis

perl security update

Type/Severity

Security Advisory: Important

Topic

Updated Perl packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team

Description

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

Kevin Finisterre discovered a stack based buffer overflow flaw in sperl,
the Perl setuid wrapper. A local user could create a sperl executable
script with a carefully created path name, overflowing the buffer and
leading to root privilege escalation. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0156 to
this issue.

Kevin Finisterre discovered a flaw in sperl which can cause debugging
information to be logged to arbitrary files. By setting an environment
variable, a local user could cause sperl to create, as root, files with
arbitrary filenames, or append the debugging information to existing files.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0155 to this issue.

An unsafe file permission bug was discovered in the rmtree() function in
the File::Path module. The rmtree() function removes files and directories
in an insecure manner, which could allow a local user to read or delete
arbitrary files. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0452 to this issue.

Users of Perl are advised to upgrade to this updated package, which
contains backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 146739 - CAN-2005-0155 multiple setuid perl issues (CAN-2005-0156 )
• BZ - 146774 - CAN-2004-0452 File::Path::rmtree() issue

CVEs

• CVE-2004-0452
• CVE-2005-0155
• CVE-2005-0156

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
perl-5.8.5-12.1.src.rpm	SHA-256: bc074f813d070a553f371e299c94f9f148c4e688a3f89c23e8b8e291bc191b0d
x86_64
perl-5.8.5-12.1.x86_64.rpm	SHA-256: 2a8f26ca62c7f4ae3736a590da4879478f57fe491369784e784a55984eae85e7
perl-5.8.5-12.1.x86_64.rpm	SHA-256: 2a8f26ca62c7f4ae3736a590da4879478f57fe491369784e784a55984eae85e7
perl-suidperl-5.8.5-12.1.1.x86_64.rpm	SHA-256: 2877bb4a59cdda05eab743ffefdf735687850a52b6bb8abffc1192685e4b0f61
perl-suidperl-5.8.5-12.1.1.x86_64.rpm	SHA-256: 2877bb4a59cdda05eab743ffefdf735687850a52b6bb8abffc1192685e4b0f61
ia64
perl-5.8.5-12.1.ia64.rpm	SHA-256: a8807c375d25bde0351069264463c32ceb4f1fd53225db5615cf954c737c2089
perl-5.8.5-12.1.ia64.rpm	SHA-256: a8807c375d25bde0351069264463c32ceb4f1fd53225db5615cf954c737c2089
perl-suidperl-5.8.5-12.1.1.ia64.rpm	SHA-256: 9ea850fdb8333c68077c184ea9d5033b744355922e146b541bb72c0afe35e9a5
perl-suidperl-5.8.5-12.1.1.ia64.rpm	SHA-256: 9ea850fdb8333c68077c184ea9d5033b744355922e146b541bb72c0afe35e9a5
i386
perl-5.8.5-12.1.i386.rpm	SHA-256: b307471ac3347b1b1a186727c77d634396852787203756cf852a111bd3aa90e0
perl-5.8.5-12.1.i386.rpm	SHA-256: b307471ac3347b1b1a186727c77d634396852787203756cf852a111bd3aa90e0
perl-suidperl-5.8.5-12.1.1.i386.rpm	SHA-256: 85d21eea0ffd1582e7f40446dce9d936bdae0db0bc7a71cb36cc760f299da0c5
perl-suidperl-5.8.5-12.1.1.i386.rpm	SHA-256: 85d21eea0ffd1582e7f40446dce9d936bdae0db0bc7a71cb36cc760f299da0c5

Red Hat Enterprise Linux Workstation 4

SRPM
perl-5.8.5-12.1.src.rpm	SHA-256: bc074f813d070a553f371e299c94f9f148c4e688a3f89c23e8b8e291bc191b0d
x86_64
perl-5.8.5-12.1.x86_64.rpm	SHA-256: 2a8f26ca62c7f4ae3736a590da4879478f57fe491369784e784a55984eae85e7
perl-suidperl-5.8.5-12.1.1.x86_64.rpm	SHA-256: 2877bb4a59cdda05eab743ffefdf735687850a52b6bb8abffc1192685e4b0f61
ia64
perl-5.8.5-12.1.ia64.rpm	SHA-256: a8807c375d25bde0351069264463c32ceb4f1fd53225db5615cf954c737c2089
perl-suidperl-5.8.5-12.1.1.ia64.rpm	SHA-256: 9ea850fdb8333c68077c184ea9d5033b744355922e146b541bb72c0afe35e9a5
i386
perl-5.8.5-12.1.i386.rpm	SHA-256: b307471ac3347b1b1a186727c77d634396852787203756cf852a111bd3aa90e0
perl-suidperl-5.8.5-12.1.1.i386.rpm	SHA-256: 85d21eea0ffd1582e7f40446dce9d936bdae0db0bc7a71cb36cc760f299da0c5

Red Hat Enterprise Linux Desktop 4

SRPM
perl-5.8.5-12.1.src.rpm	SHA-256: bc074f813d070a553f371e299c94f9f148c4e688a3f89c23e8b8e291bc191b0d
x86_64
perl-5.8.5-12.1.x86_64.rpm	SHA-256: 2a8f26ca62c7f4ae3736a590da4879478f57fe491369784e784a55984eae85e7
perl-suidperl-5.8.5-12.1.1.x86_64.rpm	SHA-256: 2877bb4a59cdda05eab743ffefdf735687850a52b6bb8abffc1192685e4b0f61
i386
perl-5.8.5-12.1.i386.rpm	SHA-256: b307471ac3347b1b1a186727c77d634396852787203756cf852a111bd3aa90e0
perl-suidperl-5.8.5-12.1.1.i386.rpm	SHA-256: 85d21eea0ffd1582e7f40446dce9d936bdae0db0bc7a71cb36cc760f299da0c5

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
perl-5.8.5-12.1.src.rpm	SHA-256: bc074f813d070a553f371e299c94f9f148c4e688a3f89c23e8b8e291bc191b0d
s390x
perl-5.8.5-12.1.s390x.rpm	SHA-256: 810a3f0c299dcdc0f57099d63812a9fef5611fd29f0bcc8a558dfc14f2316617
perl-suidperl-5.8.5-12.1.1.s390x.rpm	SHA-256: 7d0968a44bad65f45d38dacc578043edb649401aae015665f4139baf80bb56ed
s390
perl-5.8.5-12.1.s390.rpm	SHA-256: 79248d28c6757196eeb8633ffdf81a2ada6a575fe9b665fc82330d0be37e9d5f
perl-suidperl-5.8.5-12.1.1.s390.rpm	SHA-256: 9be1cfd8d1e61ab4d481cad700bc819206e991cb26e412b6a2f908f6ae813e8a

Red Hat Enterprise Linux for Power, big endian 4

SRPM
perl-5.8.5-12.1.src.rpm	SHA-256: bc074f813d070a553f371e299c94f9f148c4e688a3f89c23e8b8e291bc191b0d
ppc
perl-5.8.5-12.1.ppc.rpm	SHA-256: 10d65ad9808e2ae6db9a2ad271acbf4495c3644bab0bfd869e48753bdfd05971
perl-suidperl-5.8.5-12.1.1.ppc.rpm	SHA-256: f281e141197c64f45e37867298fb0a058fe14a3d4d8a3aee5fa171f22e8977e7