Skip to navigation

Security Advisory Moderate: perl security update

Advisory: RHSA-2011:1797-1
Type: Security Advisory
Severity: Moderate
Issued on: 2011-12-08
Last updated on: 2011-12-08
Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2010-2761
CVE-2010-4410
CVE-2011-3597

Details

Updated perl packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Perl is a high-level programming language commonly used for system
administration utilities and web programming.

It was found that the "new" constructor of the Digest module used its
argument as part of the string expression passed to the eval() function. An
attacker could possibly use this flaw to execute arbitrary Perl code with
the privileges of a Perl program that uses untrusted input as an argument
to the constructor. (CVE-2011-3597)

It was found that the Perl CGI module used a hard-coded value for the MIME
boundary string in multipart/x-mixed-replace content. A remote attacker
could possibly use this flaw to conduct an HTTP response splitting attack
via a specially-crafted HTTP request. (CVE-2010-2761)

A CRLF injection flaw was found in the way the Perl CGI module processed a
sequence of non-whitespace preceded by newline characters in the header. A
remote attacker could use this flaw to conduct an HTTP response splitting
attack via a specially-crafted sequence of characters provided to the CGI
module. (CVE-2010-4410)

All Perl users should upgrade to these updated packages, which contain
backported patches to correct these issues. All running Perl programs must
be restarted for this update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Updated packages

Red Hat Desktop (v. 4)

SRPMS:
perl-5.8.5-57.el4.src.rpm     MD5: ace71ca01ba6604cb7fd6111ff2295f6
SHA-256: 24f389ffb773821773e2acdadb01c7e0a8128a25b20fe9a824b7f673f90f5b2f
 
IA-32:
perl-5.8.5-57.el4.i386.rpm     MD5: b1af3fb26dac15222a4a8766f0b4611f
SHA-256: a20810492d72bc67694d28b8daf76d44e6c087ca897543c2a959f3365adec3b0
perl-suidperl-5.8.5-57.el4.i386.rpm     MD5: 1ca849837c8193c765acf5ff1c2c6863
SHA-256: 44c93e25e26b8c8e24c6d7250aa44ab8322e8bad2fbbbd773858a4f21629bfcd
 
x86_64:
perl-5.8.5-57.el4.x86_64.rpm     MD5: bb9da13411e7ad15a11afe09e3b1333e
SHA-256: 266cb8f40f9c245e43e72201ee72b3c585712fa3e44be0bc947069dc758e4ccb
perl-suidperl-5.8.5-57.el4.x86_64.rpm     MD5: cb8491b7d4442dd7c8856335326d5bc9
SHA-256: 3be067ae98bf0ccbaae0b57cffc104808d524e868b4b6df07ff38a5d26c03b16
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
perl-5.8.8-32.el5_7.6.src.rpm
File outdated by:  RHBA-2013:1296
    MD5: 4b817de2c844e8c05743c5277a8b1eb9
SHA-256: feb4940ce9c35f7eacceb3a480a253761878cfc455d3256eff0a235e5c5b18fc
 
IA-32:
perl-5.8.8-32.el5_7.6.i386.rpm
File outdated by:  RHBA-2013:1296
    MD5: d3ea4b4990094fdfd3cc7a422f825f37
SHA-256: ff36e7084fefb8747de87bab6457677de8590ebbc0dca0b3dc0cbeb3b1988983
perl-suidperl-5.8.8-32.el5_7.6.i386.rpm
File outdated by:  RHBA-2013:1296
    MD5: 69d26c7659cfc40fa789766875bf3429
SHA-256: 9ae7a7f8bcfe666d546ce96a0ca930f54a599f79b1dc7ada3603777a3dc5eba3
 
IA-64:
perl-5.8.8-32.el5_7.6.ia64.rpm
File outdated by:  RHBA-2013:1296
    MD5: dcc61d999421bb0e0839d441e466b4db
SHA-256: 320c84db1a6f3f5d41f6082363ad2422c3ade0e3ee64353a9c46075a1d6c3ec1
perl-suidperl-5.8.8-32.el5_7.6.ia64.rpm
File outdated by:  RHBA-2013:1296
    MD5: 65bf134df7dd86e9629357cb4275f377
SHA-256: 13cfcec15ca7e9771b5409f5597e2b2f9529a2059dd0c58d016e0517f079af9d
 
PPC:
perl-5.8.8-32.el5_7.6.ppc.rpm
File outdated by:  RHBA-2013:1296
    MD5: 7b48fdfb60e18ff21e39876ec243e6dd
SHA-256: c0bd9c3a7fa87683d9839f9cf2ac9da4b4737f6d2e6aa88d36ed3efa8c0b5624
perl-suidperl-5.8.8-32.el5_7.6.ppc.rpm
File outdated by:  RHBA-2013:1296
    MD5: ca0c4204f266ad582c45a91fb8d4bd7a
SHA-256: 3a2114473b59e91c2a393790384ae7ed489cbc5f2fee6f1837429e0e61a1672b
 
s390x:
perl-5.8.8-32.el5_7.6.s390x.rpm
File outdated by:  RHBA-2013:1296
    MD5: 01e1523e2ab59a51dce0592091168ce4
SHA-256: a0ad6c26d34962df51c1089b7ffa3c0416fc6e0bb5c53eb8ccc1b771606b3e7f
perl-suidperl-5.8.8-32.el5_7.6.s390x.rpm
File outdated by:  RHBA-2013:1296
    MD5: c03826985eadefec72d4cfca53340189
SHA-256: 9e1284b0654fede08510fb1fa4b02ae101e51291ac675a62e336b2f3f41e4da4
 
x86_64:
perl-5.8.8-32.el5_7.6.x86_64.rpm
File outdated by:  RHBA-2013:1296
    MD5: e6113472fe90ec531483031f4db82813
SHA-256: 1969d1361edb19d4afbc896d95ebb7b27d5c0e5ce8b49c85bb6f66d67d3e5905
perl-suidperl-5.8.8-32.el5_7.6.x86_64.rpm
File outdated by:  RHBA-2013:1296
    MD5: 2a12683c84cb294f9b5fc1d4396fc3a6
SHA-256: 8656ca412e874249d11c8370fc388f172217dcb9426f8cd988a8747d65c3edc0
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
perl-5.8.5-57.el4.src.rpm     MD5: ace71ca01ba6604cb7fd6111ff2295f6
SHA-256: 24f389ffb773821773e2acdadb01c7e0a8128a25b20fe9a824b7f673f90f5b2f
 
IA-32:
perl-5.8.5-57.el4.i386.rpm     MD5: b1af3fb26dac15222a4a8766f0b4611f
SHA-256: a20810492d72bc67694d28b8daf76d44e6c087ca897543c2a959f3365adec3b0
perl-suidperl-5.8.5-57.el4.i386.rpm     MD5: 1ca849837c8193c765acf5ff1c2c6863
SHA-256: 44c93e25e26b8c8e24c6d7250aa44ab8322e8bad2fbbbd773858a4f21629bfcd
 
IA-64:
perl-5.8.5-57.el4.ia64.rpm     MD5: 22fbab66b49e6072edbf897986f5b541
SHA-256: 4d3b8fe1e067b294e87264af4d7d71243dd2f54f645786d2fbf0d097627254ea
perl-suidperl-5.8.5-57.el4.ia64.rpm     MD5: 137457e6ae73e1d1426673f98ad03ce8
SHA-256: 12353b391ad77e69ec84b281b6fcb80bcc7cc154a590f1ce60e2933b55de61b3
 
PPC:
perl-5.8.5-57.el4.ppc.rpm     MD5: 19c7eed1bf1f25e500d511c135445b82
SHA-256: 352a189db056d2b39e5591a7515fd12ad5ad13156197aca3ededb365427e9194
perl-suidperl-5.8.5-57.el4.ppc.rpm     MD5: 35c2fbd874be79c446b47b8298e3e468
SHA-256: 1c0d4140845bba60dc7e45f22bb84a69c317535b27a85d1c82cb14b3e9738b90
 
s390:
perl-5.8.5-57.el4.s390.rpm     MD5: 40919d38997cd174bb52b94936ce13b6
SHA-256: 85cab0b0196b6211bd572667a9a69db4575fe522d4fb67b1d2b5a02699984b9a
perl-suidperl-5.8.5-57.el4.s390.rpm     MD5: 0a649010754ff855ecae4b87d9fdc2c3
SHA-256: fde3b27c0ae203cd50664b00c4469ddc2a7032c8118285793611a26d5ce13c48
 
s390x:
perl-5.8.5-57.el4.s390x.rpm     MD5: 9efd138653c108b5b99a927d9fb8f8ca
SHA-256: 9401cd743cc05fd6602622a6e956c017b87a7bd056a5b6a5e6bc14e74b2d349b
perl-suidperl-5.8.5-57.el4.s390x.rpm     MD5: 9b577d970f92f5320bc20656b92b0298
SHA-256: acfd4381c3468b359a0ff253176cbe0f2949abc738ff1233404bbc545ef144b1
 
x86_64:
perl-5.8.5-57.el4.x86_64.rpm     MD5: bb9da13411e7ad15a11afe09e3b1333e
SHA-256: 266cb8f40f9c245e43e72201ee72b3c585712fa3e44be0bc947069dc758e4ccb
perl-suidperl-5.8.5-57.el4.x86_64.rpm     MD5: cb8491b7d4442dd7c8856335326d5bc9
SHA-256: 3be067ae98bf0ccbaae0b57cffc104808d524e868b4b6df07ff38a5d26c03b16
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
perl-5.8.8-32.el5_7.6.src.rpm
File outdated by:  RHBA-2013:1296
    MD5: 4b817de2c844e8c05743c5277a8b1eb9
SHA-256: feb4940ce9c35f7eacceb3a480a253761878cfc455d3256eff0a235e5c5b18fc
 
IA-32:
perl-5.8.8-32.el5_7.6.i386.rpm
File outdated by:  RHBA-2013:1296
    MD5: d3ea4b4990094fdfd3cc7a422f825f37
SHA-256: ff36e7084fefb8747de87bab6457677de8590ebbc0dca0b3dc0cbeb3b1988983
perl-suidperl-5.8.8-32.el5_7.6.i386.rpm
File outdated by:  RHBA-2013:1296
    MD5: 69d26c7659cfc40fa789766875bf3429
SHA-256: 9ae7a7f8bcfe666d546ce96a0ca930f54a599f79b1dc7ada3603777a3dc5eba3
 
x86_64:
perl-5.8.8-32.el5_7.6.i386.rpm
File outdated by:  RHBA-2013:1296
    MD5: d3ea4b4990094fdfd3cc7a422f825f37
SHA-256: ff36e7084fefb8747de87bab6457677de8590ebbc0dca0b3dc0cbeb3b1988983
perl-5.8.8-32.el5_7.6.x86_64.rpm
File outdated by:  RHBA-2013:1296
    MD5: e6113472fe90ec531483031f4db82813
SHA-256: 1969d1361edb19d4afbc896d95ebb7b27d5c0e5ce8b49c85bb6f66d67d3e5905
perl-suidperl-5.8.8-32.el5_7.6.x86_64.rpm
File outdated by:  RHBA-2013:1296
    MD5: 2a12683c84cb294f9b5fc1d4396fc3a6
SHA-256: 8656ca412e874249d11c8370fc388f172217dcb9426f8cd988a8747d65c3edc0
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
perl-5.8.5-57.el4.src.rpm     MD5: ace71ca01ba6604cb7fd6111ff2295f6
SHA-256: 24f389ffb773821773e2acdadb01c7e0a8128a25b20fe9a824b7f673f90f5b2f
 
IA-32:
perl-5.8.5-57.el4.i386.rpm     MD5: b1af3fb26dac15222a4a8766f0b4611f
SHA-256: a20810492d72bc67694d28b8daf76d44e6c087ca897543c2a959f3365adec3b0
perl-suidperl-5.8.5-57.el4.i386.rpm     MD5: 1ca849837c8193c765acf5ff1c2c6863
SHA-256: 44c93e25e26b8c8e24c6d7250aa44ab8322e8bad2fbbbd773858a4f21629bfcd
 
IA-64:
perl-5.8.5-57.el4.ia64.rpm     MD5: 22fbab66b49e6072edbf897986f5b541
SHA-256: 4d3b8fe1e067b294e87264af4d7d71243dd2f54f645786d2fbf0d097627254ea
perl-suidperl-5.8.5-57.el4.ia64.rpm     MD5: 137457e6ae73e1d1426673f98ad03ce8
SHA-256: 12353b391ad77e69ec84b281b6fcb80bcc7cc154a590f1ce60e2933b55de61b3
 
x86_64:
perl-5.8.5-57.el4.x86_64.rpm     MD5: bb9da13411e7ad15a11afe09e3b1333e
SHA-256: 266cb8f40f9c245e43e72201ee72b3c585712fa3e44be0bc947069dc758e4ccb
perl-suidperl-5.8.5-57.el4.x86_64.rpm     MD5: cb8491b7d4442dd7c8856335326d5bc9
SHA-256: 3be067ae98bf0ccbaae0b57cffc104808d524e868b4b6df07ff38a5d26c03b16
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
perl-5.8.5-57.el4.src.rpm     MD5: ace71ca01ba6604cb7fd6111ff2295f6
SHA-256: 24f389ffb773821773e2acdadb01c7e0a8128a25b20fe9a824b7f673f90f5b2f
 
IA-32:
perl-5.8.5-57.el4.i386.rpm     MD5: b1af3fb26dac15222a4a8766f0b4611f
SHA-256: a20810492d72bc67694d28b8daf76d44e6c087ca897543c2a959f3365adec3b0
perl-suidperl-5.8.5-57.el4.i386.rpm     MD5: 1ca849837c8193c765acf5ff1c2c6863
SHA-256: 44c93e25e26b8c8e24c6d7250aa44ab8322e8bad2fbbbd773858a4f21629bfcd
 
IA-64:
perl-5.8.5-57.el4.ia64.rpm     MD5: 22fbab66b49e6072edbf897986f5b541
SHA-256: 4d3b8fe1e067b294e87264af4d7d71243dd2f54f645786d2fbf0d097627254ea
perl-suidperl-5.8.5-57.el4.ia64.rpm     MD5: 137457e6ae73e1d1426673f98ad03ce8
SHA-256: 12353b391ad77e69ec84b281b6fcb80bcc7cc154a590f1ce60e2933b55de61b3
 
x86_64:
perl-5.8.5-57.el4.x86_64.rpm     MD5: bb9da13411e7ad15a11afe09e3b1333e
SHA-256: 266cb8f40f9c245e43e72201ee72b3c585712fa3e44be0bc947069dc758e4ccb
perl-suidperl-5.8.5-57.el4.x86_64.rpm     MD5: cb8491b7d4442dd7c8856335326d5bc9
SHA-256: 3be067ae98bf0ccbaae0b57cffc104808d524e868b4b6df07ff38a5d26c03b16
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

658976 - perl-CGI, perl-CGI-Simple: CVE-2010-2761 - hardcoded MIME boundary value for multipart content, CVE-2010-4410 - CRLF injection allowing HTTP response splitting
743010 - CVE-2011-3597 Perl Digest improper control of generation of code


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/