Updated mailx and perl packages are now available.

Updated perl and mailx package are now available which fix a potential
exploit made possible by incorrect assumptions made in suidperl.

This advisory contains additional instructions for installing the necessary
updates.

Under certain conditions, suidperl will attempt to send mail to the local
superuser account using /bin/mail. A properly formatted exploit script can
use this facility, along with mailx's tendency to inherit settings from the
environment, to gain local root access.

This update changes suidperl's behavior to use syslog instead of mail, and
restricts the list of variables /bin/mail will read from the environment.

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

In order to install some of these packages, you may need to have a newer
version of RPM installed. Information about obtaining the new version of
RPM is included in RHSA-2000:051.

15641 - suidperl has a major problem

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0703
http://www.securityfocus.com/vdb/bottom.html?vid=1547
http://bugs.perl.org/perlbug.cgi?req=tidmids&tidmids=20000806.001

rpm