Skip to navigation

Security Advisory perl security update

Advisory: RHSA-2005:105-11
Type: Security Advisory
Severity: Important
Issued on: 2005-02-07
Last updated on: 2005-02-07
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
CVEs (cve.mitre.org): CVE-2004-0452
CVE-2005-0155
CVE-2005-0156

Details

Updated Perl packages that fix several security issues are now available
for Red Hat Enterprise Linux 3.

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

Kevin Finisterre discovered a stack based buffer overflow flaw in sperl,
the Perl setuid wrapper. A local user could create a sperl executable
script with a carefully created path name, overflowing the buffer and
leading to root privilege escalation. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0156 to
this issue.

Kevin Finisterre discovered a flaw in sperl which can cause debugging
information to be logged to arbitrary files. By setting an environment
variable, a local user could cause sperl to create, as root, files with
arbitrary filenames, or append the debugging information to existing files.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0155 to this issue.

Users of Perl are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 3)

IA-32:
perl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: f223540941913b1d8b55568626028560
perl-CGI-2.81-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: c3edc74d92002a36b1b5148027f55f34
perl-CPAN-1.61-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: a3b61ea8cafa5243a8d46e5ab98e73bf
perl-DB_File-1.804-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 58b85c5089fd027fb4a8cf905c8ec011
perl-suidperl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 4f5b8e750cccb89ae45bf4c98bc4cda7
 
x86_64:
perl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 8db0f4090e24987d0c8441bc7a51e279
perl-CGI-2.81-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: df2aa650b197e77760f34f01e6b53531
perl-CPAN-1.61-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 123bd96c68b24decf64225873e4d7b27
perl-DB_File-1.804-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: b8c4afe9bb806c65b9dd38e3ba20c49a
perl-suidperl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: e1b1a5af0febb77cedcd523f13a8d129
 
Red Hat Enterprise Linux AS (v. 3)

IA-32:
perl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: f223540941913b1d8b55568626028560
perl-CGI-2.81-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: c3edc74d92002a36b1b5148027f55f34
perl-CPAN-1.61-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: a3b61ea8cafa5243a8d46e5ab98e73bf
perl-DB_File-1.804-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 58b85c5089fd027fb4a8cf905c8ec011
perl-suidperl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 4f5b8e750cccb89ae45bf4c98bc4cda7
 
IA-64:
perl-5.8.0-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 5a10e253f3f2157b4368075eccf54175
perl-CGI-2.81-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 05ea625a88b1e659b5a6880edac843c7
perl-CPAN-1.61-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 8724618846f36f99812357b454f7c55c
perl-DB_File-1.804-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 825c3f4ef53327a732378c949e1b147c
perl-suidperl-5.8.0-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: b324050c23db82bc43bc8a51ac2ac007
 
PPC:
perl-5.8.0-89.10.ppc.rpm
File outdated by:  RHSA-2010:0457
    MD5: 2362025e5f6d031811ee22f74843fb94
perl-CGI-2.81-89.10.ppc.rpm
File outdated by:  RHSA-2010:0457
    MD5: 6e9457f9598a2e4e188533817b23e33a
perl-CPAN-1.61-89.10.ppc.rpm
File outdated by:  RHSA-2010:0457
    MD5: ce29cbfa817b49b9a412be3f55615f45
perl-DB_File-1.804-89.10.ppc.rpm
File outdated by:  RHSA-2010:0457
    MD5: 102055d8cf74105148c5daceb28f1910
perl-suidperl-5.8.0-89.10.ppc.rpm
File outdated by:  RHSA-2010:0457
    MD5: e3eba2620074e27bcb5fa946f4fd4777
 
s390:
perl-5.8.0-89.10.s390.rpm
File outdated by:  RHSA-2010:0457
    MD5: 1615bfaeed759172f02469c15c67f699
perl-CGI-2.81-89.10.s390.rpm
File outdated by:  RHSA-2010:0457
    MD5: fa7f3cd690f121378b1672fdf8eef997
perl-CPAN-1.61-89.10.s390.rpm
File outdated by:  RHSA-2010:0457
    MD5: 318cdf1c55f23444c688955717466b74
perl-DB_File-1.804-89.10.s390.rpm
File outdated by:  RHSA-2010:0457
    MD5: 93274d0a1f1fd9b8dc0119d8b9b7b737
perl-suidperl-5.8.0-89.10.s390.rpm
File outdated by:  RHSA-2010:0457
    MD5: 3367fbba7b1e02c2b7d41c0f6fde0f3a
 
s390x:
perl-5.8.0-89.10.s390x.rpm
File outdated by:  RHSA-2010:0457
    MD5: f71c7397ad5802d3d13dd6b795f8e150
perl-CGI-2.81-89.10.s390x.rpm
File outdated by:  RHSA-2010:0457
    MD5: a86fa1fa4f7f63ce00e156678f54e479
perl-CPAN-1.61-89.10.s390x.rpm
File outdated by:  RHSA-2010:0457
    MD5: f9957856800d1d8693de6a621c32796c
perl-DB_File-1.804-89.10.s390x.rpm
File outdated by:  RHSA-2010:0457
    MD5: c406fb5ed06667f7263e0faaf8cf7276
perl-suidperl-5.8.0-89.10.s390x.rpm
File outdated by:  RHSA-2010:0457
    MD5: 9a94ee60285209ed064915c19f8d59d7
 
x86_64:
perl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 8db0f4090e24987d0c8441bc7a51e279
perl-CGI-2.81-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: df2aa650b197e77760f34f01e6b53531
perl-CPAN-1.61-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 123bd96c68b24decf64225873e4d7b27
perl-DB_File-1.804-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: b8c4afe9bb806c65b9dd38e3ba20c49a
perl-suidperl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: e1b1a5af0febb77cedcd523f13a8d129
 
Red Hat Enterprise Linux ES (v. 3)

IA-32:
perl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: f223540941913b1d8b55568626028560
perl-CGI-2.81-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: c3edc74d92002a36b1b5148027f55f34
perl-CPAN-1.61-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: a3b61ea8cafa5243a8d46e5ab98e73bf
perl-DB_File-1.804-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 58b85c5089fd027fb4a8cf905c8ec011
perl-suidperl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 4f5b8e750cccb89ae45bf4c98bc4cda7
 
IA-64:
perl-5.8.0-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 5a10e253f3f2157b4368075eccf54175
perl-CGI-2.81-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 05ea625a88b1e659b5a6880edac843c7
perl-CPAN-1.61-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 8724618846f36f99812357b454f7c55c
perl-DB_File-1.804-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 825c3f4ef53327a732378c949e1b147c
perl-suidperl-5.8.0-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: b324050c23db82bc43bc8a51ac2ac007
 
x86_64:
perl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 8db0f4090e24987d0c8441bc7a51e279
perl-CGI-2.81-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: df2aa650b197e77760f34f01e6b53531
perl-CPAN-1.61-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 123bd96c68b24decf64225873e4d7b27
perl-DB_File-1.804-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: b8c4afe9bb806c65b9dd38e3ba20c49a
perl-suidperl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: e1b1a5af0febb77cedcd523f13a8d129
 
Red Hat Enterprise Linux WS (v. 3)

IA-32:
perl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: f223540941913b1d8b55568626028560
perl-CGI-2.81-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: c3edc74d92002a36b1b5148027f55f34
perl-CPAN-1.61-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: a3b61ea8cafa5243a8d46e5ab98e73bf
perl-DB_File-1.804-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 58b85c5089fd027fb4a8cf905c8ec011
perl-suidperl-5.8.0-89.10.i386.rpm
File outdated by:  RHSA-2010:0457
    MD5: 4f5b8e750cccb89ae45bf4c98bc4cda7
 
IA-64:
perl-5.8.0-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 5a10e253f3f2157b4368075eccf54175
perl-CGI-2.81-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 05ea625a88b1e659b5a6880edac843c7
perl-CPAN-1.61-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 8724618846f36f99812357b454f7c55c
perl-DB_File-1.804-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 825c3f4ef53327a732378c949e1b147c
perl-suidperl-5.8.0-89.10.ia64.rpm
File outdated by:  RHSA-2010:0457
    MD5: b324050c23db82bc43bc8a51ac2ac007
 
x86_64:
perl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 8db0f4090e24987d0c8441bc7a51e279
perl-CGI-2.81-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: df2aa650b197e77760f34f01e6b53531
perl-CPAN-1.61-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: 123bd96c68b24decf64225873e4d7b27
perl-DB_File-1.804-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: b8c4afe9bb806c65b9dd38e3ba20c49a
perl-suidperl-5.8.0-89.10.x86_64.rpm
File outdated by:  RHSA-2010:0457
    MD5: e1b1a5af0febb77cedcd523f13a8d129
 

Bugs fixed (see bugzilla for more information)

140227 - Potential insecurity in CGI.pm
146737 - CAN-2005-0155 multiple setuid perl issues (CAN-2005-0156)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/