Vulnerability Bulletins |
Condición de carrera en la función rmtree de perl |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Aumento de privilegios |
| Dificulty | Experto |
| Required attacker level | Acceso remoto con cuenta |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software | perl |
Description |
|
|
Se ha descubierto una condición de carrera en la función File::Path::rmtree de perl. Cuando un proceso borra un árbol de directorios un atacante podría explotar la vulnerabilidad para crear binarios setuid en ese árbol de directorios. Es requisito que el atacante tenga permisos de escritura en alguna localización de ese árbol de directorios. |
|
Solution |
|
|
Actualización de software Debian Linux Debian Linux 3.0 Source http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9.dsc http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9.diff.gz http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1.orig.tar.gz Architecture independent http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.6.1-8.9_all.deb http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.6.1-8.9_all.deb http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.6.1-8.9_all.deb Alpha http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_alpha.deb ARM http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_arm.deb Intel IA-32 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_i386.deb Intel IA-64 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_ia64.deb HP Precision http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_hppa.deb Motorola 680x0 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_m68k.deb Big endian MIPS http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_mips.deb Little endian MIPS http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_mipsel.deb PowerPC http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_powerpc.deb IBM S/390 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_s390.deb Sun Sparc http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_sparc.deb Mandriva Linux Mandrakelinux 10.0 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-base-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-devel-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-doc-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/SRPMS/perl-5.8.3-5.4.100mdk.src.rpm AMD64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-base-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-devel-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-doc-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/SRPMS/perl-5.8.3-5.4.100mdk.src.rpm Mandrakelinux 10.1 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-base-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-devel-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-doc-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/SRPMS/perl-5.8.5-3.4.101mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-base-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-devel-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-doc-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/SRPMS/perl-5.8.5-3.4.101mdk.src.rpm Corporate Server 2.1 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-base-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-devel-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-doc-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/SRPMS/perl-5.8.0-14.5.C21mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-base-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-devel-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-doc-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/SRPMS/perl-5.8.0-14.5.C21mdk.src.rpm Corporate Server 3.0 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-base-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-devel-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-doc-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/perl-5.8.3-5.4.C30mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-base-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-devel-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-doc-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/perl-5.8.3-5.4.C30mdk.src.rpm Mandrivalinux LE2005 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-base-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-devel-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-doc-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/SRPMS/perl-5.8.6-6.1.102mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-base-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-devel-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-doc-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/SRPMS/perl-5.8.6-6.1.102mdk.src.rpm HP HP-UX 11.00 PA-RISC PERL 5.8.0 - Instalar perl_D.5.8.0.G_HP-UX_B.11.00_32+64.depot PERL 5.8.2 - Instalar perl_D.5.8.2.D_HP-UX_B.11.00_32+64.depot PERL 5.8.3 - Instalar perl_D.5.8.3.B_HP-UX_B.11.00_32+64.depot http://software.hp.com/ HP-UX 11i v1.0 PA-RISC PERL 5.8.0 - Instalar perl_D.5.8.0.G_HP-UX_B.11.11_32+64.depot PERL 5.8.2 - Instalar perl_D.5.8.2.D_HP-UX_B.11.11_32+64.depot PERL 5.8.3 - Instalar perl_D.5.8.3.B_HP-UX_B.11.11_32+64.depot http://software.hp.com/ HP-UX 11i v1.0409 (IA, PA) PERL 5.8.0 - Instalar perl_D.5.8.0.G_HP-UX_B.11.23_IA+PA.depot PERL 5.8.2 - Instalar perl_D.5.8.2.F_HP-UX_B.11.23_IA+PA.depot PERL 5.8.3 - Instalar perl_D.5.8.3.B_HP-UX_B.11.23_IA+PA.depot http://software.hp.com/ Red Hat Red Hat Desktop (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Desktop (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Desktop (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm Red Hat Enterprise Linux AS (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Enterprise Linux AS (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Enterprise Linux AS (v. 4) / IA-64 perl-5.8.5-16.RHEL4.ia64.rpm perl-suidperl-5.8.5-16.RHEL4.ia64.rpm Red Hat Enterprise Linux AS (v. 4) / PPC perl-5.8.5-16.RHEL4.ppc.rpm perl-suidperl-5.8.5-16.RHEL4.ppc.rpm Red Hat Enterprise Linux AS (v. 4) / s390 perl-5.8.5-16.RHEL4.s390.rpm perl-suidperl-5.8.5-16.RHEL4.s390.rpm Red Hat Enterprise Linux AS (v. 4) / s390x perl-5.8.5-16.RHEL4.s390x.rpm perl-suidperl-5.8.5-16.RHEL4.s390x.rpm Red Hat Enterprise Linux AS (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm Red Hat Enterprise Linux ES (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Enterprise Linux ES (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Enterprise Linux ES (v. 4) / IA-64 perl-5.8.5-16.RHEL4.ia64.rpm perl-suidperl-5.8.5-16.RHEL4.ia64.rpm Red Hat Enterprise Linux ES (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm Red Hat Enterprise Linux WS (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Enterprise Linux WS (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Enterprise Linux WS (v. 4) / IA-64 perl-5.8.5-16.RHEL4.ia64.rpm perl-suidperl-5.8.5-16.RHEL4.ia64.rpm Red Hat Enterprise Linux WS (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm SGI Advanced Linux Environment 3 / RPM / Patch 10258 ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS Advanced Linux Environment 3 / SRPM / Patch 10258 ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS |
|
Standar resources |
|
| Property | Value |
| CVE | CAN-2005-0448 |
| BID | |
Other resources |
|
|
Debian Security Advisory DSA 696-1 http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00076.html Mandriva Security Advisories MDKSA-2005:079 http://www.mandriva.com/security/advisories?name=MDKSA-2005:079 HP SECURITY BULLETIN HPSBUX01208 http://www5.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01208 Red Hat Security Advisory (RHSA-2005:674-10) https://rhn.redhat.com/errata/RHSA-2005-674.html SGI Security Advisory (20060101-01-U) ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U.asc |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2005-03-23 |
| 1.1 | Aviso emitido por Mandriva (MDKSA-2005:079) | 2005-05-02 |
| 1.2 | Aviso emitido por HP (HPSBUX01208) | 2005-06-17 |
| 1.3 | Aviso emitido por Red Hat (RHSA-2005:674-10) | 2005-10-17 |
| 1.4 | Aviso emitido por SGI (20060101-01-U) | 2006-01-19 |