Skip to navigation

Security Advisory Updated Perl packages fix security issues.

Advisory: RHSA-2003:256-15
Type: Security Advisory
Severity: N/A
Issued on: 2003-09-22
Last updated on: 2003-10-03
Affected Products: Red Hat Linux 7.1
Red Hat Linux 7.1 for iSeries
Red Hat Linux 7.1 for pSeries
Red Hat Linux 7.2
Red Hat Linux 7.3
Red Hat Linux 8.0
Red Hat Linux 9
CVEs (cve.mitre.org): CVE-2002-1323
CVE-2003-0615

Details

Updated Perl packages that fix a security issue in Safe.pm and a cross-site
scripting (XSS) vulnerability in CGI.pm are now available.

[Updated 3 Oct 2003]
Added updated mod_perl packages for Red Hat Linux 7.1, which are required
due to the move to Perl version 5.6.1 on this platform.

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

Two security issues have been found in Perl that affect the Perl packages
shipped with Red Hat Linux:

When safe.pm versions 2.0.7 and earlier are used with Perl 5.8.0 and
earlier, it is possible for an attacker to break out of safe compartments
within Safe::reval and Safe::rdo by using a redefined @_ variable. This is
due to the fact that the redefined @_ variable is not reset between
successive calls. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1323 to this issue. NOTE:
This issue does not affect the Perl packages which shipped with Red Hat
Linux 9.

A cross-site scripting vulnerability was discovered in the start_form()
function of CGI.pm. The vulnerability allows a remote attacker to insert a
Web script via a URL fed into the form's action parameter. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0615 to this issue.

Users of Perl are advised to upgrade to the packages contained within this
erratum. For Red Hat Linux 7.1, 7.2, and 7.3, Perl version 5.6.1 contains
backported security patches addressing these issues. For Red Hat Linux 8.0
and 9, Perl version 5.8.0 is supplied, which is not vulnerable to issue
CAN-2003-1323 and which contains a backported security patch addressing
issue CAN-2003-0615.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL Certificate
Errors, you need to install a version of the up2date client with an updated
certificate. The latest version of up2date is available from the Red Hat
FTP site and may also be downloaded directly from the RHN website:

https://rhn.redhat.com/help/latest-up2date.pxt

Updated packages

Red Hat Linux 7.1

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/mod_perl/1.24_01-2.71.2/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
Missing file
    MD5: 00b24dc4a3ffcddbfcd4e30232b0b19a
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.71/SRPMS/perl-5.6.1-36.1.71.src.rpm
Missing file
    MD5: 0994d9f0d307114b9ff5a3a84c78229b
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/mod_perl/1.24_01-2.71.2/i386/mod_perl-1.24_01-2.71.2.i386.rpm
Missing file
    MD5: 5cd594b4624d5e978ed19bc30e9fe4ed
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.71/i386/perl-5.6.1-36.1.71.i386.rpm
Missing file
    MD5: 4e5c17ee59c6f42095eb320c8d0904bd
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.752-36.1.71/i386/perl-CGI-2.752-36.1.71.i386.rpm
Missing file
    MD5: 484f2c937595632e9531b4032e29f50e
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.59_54-36.1.71/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm
Missing file
    MD5: dfc42b708073a61c3d9f9f9b5c1f7959
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.75-36.1.71/i386/perl-DB_File-1.75-36.1.71.i386.rpm
Missing file
    MD5: 60c0cabb19f411bcd427b7c683b44536
ftp://updates.redhat.com/rhn/repository/NULL/perl-NDBM_File/1.75-36.1.71/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm
Missing file
    MD5: 6c3bd193de0b1c8d19ca93838e089078
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.6.1-36.1.71/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm
Missing file
    MD5: ab6f508cd17923a23f64fa73c58d523f
 
Red Hat Linux 7.1 for iSeries

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/mod_perl/1.24_01-2.71.2/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
Missing file
    MD5: 00b24dc4a3ffcddbfcd4e30232b0b19a
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.71/SRPMS/perl-5.6.1-36.1.71.src.rpm
Missing file
    MD5: 0994d9f0d307114b9ff5a3a84c78229b
 
iSeries:
ftp://updates.redhat.com/rhn/repository/NULL/mod_perl/1.24_01-2.71.2/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm
Missing file
    MD5: 2fb2e0a065a0239f7bd768dd025c4f67
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.71/ppc/perl-5.6.1-36.1.71.ppc.rpm
Missing file
    MD5: b34bc21fdcc6c92a960f3857ad199430
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.752-36.1.71/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
Missing file
    MD5: 9d926272a2f9def6a6ed9020ab0d09b3
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.59_54-36.1.71/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
Missing file
    MD5: 3149414b45944023821923206640bbda
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.75-36.1.71/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
Missing file
    MD5: 697f05dfbdcff8e606fc372aaac2b9ee
ftp://updates.redhat.com/rhn/repository/NULL/perl-NDBM_File/1.75-36.1.71/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
Missing file
    MD5: 98aad53e528f30a469718504f82e820e
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.6.1-36.1.71/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
Missing file
    MD5: 0465a61f126fc211977f14f04b36b798
 
Red Hat Linux 7.1 for pSeries

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/mod_perl/1.24_01-2.71.2/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
Missing file
    MD5: 00b24dc4a3ffcddbfcd4e30232b0b19a
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.71/SRPMS/perl-5.6.1-36.1.71.src.rpm
Missing file
    MD5: 0994d9f0d307114b9ff5a3a84c78229b
 
pSeries:
ftp://updates.redhat.com/rhn/repository/NULL/mod_perl/1.24_01-2.71.2/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm
Missing file
    MD5: 2fb2e0a065a0239f7bd768dd025c4f67
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.71/ppc/perl-5.6.1-36.1.71.ppc.rpm
Missing file
    MD5: b34bc21fdcc6c92a960f3857ad199430
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.752-36.1.71/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
Missing file
    MD5: 9d926272a2f9def6a6ed9020ab0d09b3
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.59_54-36.1.71/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
Missing file
    MD5: 3149414b45944023821923206640bbda
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.75-36.1.71/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
Missing file
    MD5: 697f05dfbdcff8e606fc372aaac2b9ee
ftp://updates.redhat.com/rhn/repository/NULL/perl-NDBM_File/1.75-36.1.71/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
Missing file
    MD5: 98aad53e528f30a469718504f82e820e
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.6.1-36.1.71/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
Missing file
    MD5: 0465a61f126fc211977f14f04b36b798
 
Red Hat Linux 7.2

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.72/SRPMS/perl-5.6.1-36.1.72.src.rpm
Missing file
    MD5: e535d85774a13510bef89bd78b6b216f
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.72/i386/perl-5.6.1-36.1.72.i386.rpm
Missing file
    MD5: 03ab6415d69d4a102fe234f4b9f22748
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.752-36.1.72/i386/perl-CGI-2.752-36.1.72.i386.rpm
Missing file
    MD5: d585c9e8a58b09b3e5d4f87f1000db36
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.59_54-36.1.72/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm
Missing file
    MD5: 533d11a6fbc56f584aa5cd45a7dde8dd
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.75-36.1.72/i386/perl-DB_File-1.75-36.1.72.i386.rpm
Missing file
    MD5: ea118d193a1d788bc76917aaed12f111
ftp://updates.redhat.com/rhn/repository/NULL/perl-NDBM_File/1.75-36.1.72/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm
Missing file
    MD5: bd85a685357c7c9e06334120bd525915
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.6.1-36.1.72/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm
Missing file
    MD5: 1cd65737a2adb8aff508f4d17d3608c8
 
IA-64:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.72/ia64/perl-5.6.1-36.1.72.ia64.rpm
Missing file
    MD5: 01e342dd72f0d8aeacd1facfac2534a2
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.752-36.1.72/ia64/perl-CGI-2.752-36.1.72.ia64.rpm
Missing file
    MD5: b91893cb70d3fd4e3283891194747cf0
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.59_54-36.1.72/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm
Missing file
    MD5: b5d9998614b01d5238db888b4fddcc9b
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.75-36.1.72/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm
Missing file
    MD5: 6c91069b1f3128a05a4e7a0250227028
ftp://updates.redhat.com/rhn/repository/NULL/perl-NDBM_File/1.75-36.1.72/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm
Missing file
    MD5: 2f393ca8ddcd822e863d93ab5e4a1bb2
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.6.1-36.1.72/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm
Missing file
    MD5: 72af18dbe6f4667f7a726517b15c1f1a
 
Red Hat Linux 7.3

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.73/SRPMS/perl-5.6.1-36.1.73.src.rpm
Missing file
    MD5: 7b137d76ed95cbf9eecc9d660417b7ed
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.6.1-36.1.73/i386/perl-5.6.1-36.1.73.i386.rpm
Missing file
    MD5: 9a4fa98a57ff3b322ba18d9f0bb1864f
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.752-36.1.73/i386/perl-CGI-2.752-36.1.73.i386.rpm
Missing file
    MD5: 9878354d09a308efcbfe00fd6e7665d6
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.59_54-36.1.73/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm
Missing file
    MD5: ef7af3445fc8c7071febd7fd27a61b45
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.75-36.1.73/i386/perl-DB_File-1.75-36.1.73.i386.rpm
Missing file
    MD5: 79f963a7050fa706fe684b5e33923fa9
ftp://updates.redhat.com/rhn/repository/NULL/perl-NDBM_File/1.75-36.1.73/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm
Missing file
    MD5: 30119242d86c4980cb60d03a0520c5e0
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.6.1-36.1.73/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm
Missing file
    MD5: d169d03e8992fb0b016685522aa20dc9
 
Red Hat Linux 8.0

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.8.0-88.3/SRPMS/perl-5.8.0-88.3.src.rpm
Missing file
    MD5: e27cfe1c0bc442ce7ebd12928479134e
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.8.0-88.3/i386/perl-5.8.0-88.3.i386.rpm
Missing file
    MD5: 0ac800e33acab6522169d72dac29721b
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.81-88.3/i386/perl-CGI-2.81-88.3.i386.rpm
Missing file
    MD5: cc53faea268b17b68d1494e9cd4d442b
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.61-88.3/i386/perl-CPAN-1.61-88.3.i386.rpm
Missing file
    MD5: fb2a95814dbefd3a0d5f776f6bc47a27
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.804-88.3/i386/perl-DB_File-1.804-88.3.i386.rpm
Missing file
    MD5: abc1c47518fda72936a247d93a175fe4
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.8.0-88.3/i386/perl-suidperl-5.8.0-88.3.i386.rpm
Missing file
    MD5: 69bc3cf938b5b0e6ad2657ceda85d19b
 
Red Hat Linux 9

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.8.0-88.3/SRPMS/perl-5.8.0-88.3.src.rpm
Missing file
    MD5: e27cfe1c0bc442ce7ebd12928479134e
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/perl/5.8.0-88.3/i386/perl-5.8.0-88.3.i386.rpm
Missing file
    MD5: 0ac800e33acab6522169d72dac29721b
ftp://updates.redhat.com/rhn/repository/NULL/perl-CGI/2.81-88.3/i386/perl-CGI-2.81-88.3.i386.rpm
Missing file
    MD5: cc53faea268b17b68d1494e9cd4d442b
ftp://updates.redhat.com/rhn/repository/NULL/perl-CPAN/1.61-88.3/i386/perl-CPAN-1.61-88.3.i386.rpm
Missing file
    MD5: fb2a95814dbefd3a0d5f776f6bc47a27
ftp://updates.redhat.com/rhn/repository/NULL/perl-DB_File/1.804-88.3/i386/perl-DB_File-1.804-88.3.i386.rpm
Missing file
    MD5: abc1c47518fda72936a247d93a175fe4
ftp://updates.redhat.com/rhn/repository/NULL/perl-suidperl/5.8.0-88.3/i386/perl-suidperl-5.8.0-88.3.i386.rpm
Missing file
    MD5: 69bc3cf938b5b0e6ad2657ceda85d19b
 

Bugs fixed (see bugzilla for more information)

104875 - Latest Perl errata upgrades RH7.1 to 5.6.1 from 5.6.0 and breaks dependencies


References


Keywords

CGI.pm, Safe.pm


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/