Miembros de
Boletines de Vulnerabilidades |
Condición de carrera en la función rmtree de perl |
|
Clasificación de la vulnerabilidad |
|
| Propiedad | Valor |
| Nivel de Confianza | Oficial |
| Impacto | Aumento de privilegios |
| Dificultad | Experto |
| Requerimientos del atacante | Acceso remoto con cuenta |
Información sobre el sistema |
|
| Propiedad | Valor |
| Fabricante afectado | GNU/Linux |
| Software afectado | perl |
Descripción |
|
|
Se ha descubierto una condición de carrera en la función File::Path::rmtree de perl. Cuando un proceso borra un árbol de directorios un atacante podría explotar la vulnerabilidad para crear binarios setuid en ese árbol de directorios. Es requisito que el atacante tenga permisos de escritura en alguna localización de ese árbol de directorios. |
|
Solución |
|
|
Actualización de software Debian Linux Debian Linux 3.0 Source http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9.dsc http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9.diff.gz http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1.orig.tar.gz Architecture independent http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.6.1-8.9_all.deb http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.6.1-8.9_all.deb http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.6.1-8.9_all.deb Alpha http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_alpha.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_alpha.deb ARM http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_arm.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_arm.deb Intel IA-32 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_i386.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_i386.deb Intel IA-64 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_ia64.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_ia64.deb HP Precision http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_hppa.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_hppa.deb Motorola 680x0 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_m68k.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_m68k.deb Big endian MIPS http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_mips.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_mips.deb Little endian MIPS http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_mipsel.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_mipsel.deb PowerPC http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_powerpc.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_powerpc.deb IBM S/390 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_s390.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_s390.deb Sun Sparc http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.9_sparc.deb http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.9_sparc.deb Mandriva Linux Mandrakelinux 10.0 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-base-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-devel-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/RPMS/perl-doc-5.8.3-5.4.100mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.0/SRPMS/perl-5.8.3-5.4.100mdk.src.rpm AMD64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-base-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-devel-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/RPMS/perl-doc-5.8.3-5.4.100mdk.amd64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/amd64/10.0/SRPMS/perl-5.8.3-5.4.100mdk.src.rpm Mandrakelinux 10.1 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-base-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-devel-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/RPMS/perl-doc-5.8.5-3.4.101mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.1/SRPMS/perl-5.8.5-3.4.101mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-base-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-devel-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/RPMS/perl-doc-5.8.5-3.4.101mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.1/SRPMS/perl-5.8.5-3.4.101mdk.src.rpm Corporate Server 2.1 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-base-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-devel-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/RPMS/perl-doc-5.8.0-14.5.C21mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/2.1/SRPMS/perl-5.8.0-14.5.C21mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-base-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-devel-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/RPMS/perl-doc-5.8.0-14.5.C21mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/2.1/SRPMS/perl-5.8.0-14.5.C21mdk.src.rpm Corporate Server 3.0 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-base-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-devel-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/RPMS/perl-doc-5.8.3-5.4.C30mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/3.0/SRPMS/perl-5.8.3-5.4.C30mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-base-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-devel-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/RPMS/perl-doc-5.8.3-5.4.C30mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/corporate/3.0/SRPMS/perl-5.8.3-5.4.C30mdk.src.rpm Mandrivalinux LE2005 x86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-base-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-devel-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/RPMS/perl-doc-5.8.6-6.1.102mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/10.2/SRPMS/perl-5.8.6-6.1.102mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-base-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-devel-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/RPMS/perl-doc-5.8.6-6.1.102mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/x86_64/10.2/SRPMS/perl-5.8.6-6.1.102mdk.src.rpm HP HP-UX 11.00 PA-RISC PERL 5.8.0 - Instalar perl_D.5.8.0.G_HP-UX_B.11.00_32+64.depot PERL 5.8.2 - Instalar perl_D.5.8.2.D_HP-UX_B.11.00_32+64.depot PERL 5.8.3 - Instalar perl_D.5.8.3.B_HP-UX_B.11.00_32+64.depot http://software.hp.com/ HP-UX 11i v1.0 PA-RISC PERL 5.8.0 - Instalar perl_D.5.8.0.G_HP-UX_B.11.11_32+64.depot PERL 5.8.2 - Instalar perl_D.5.8.2.D_HP-UX_B.11.11_32+64.depot PERL 5.8.3 - Instalar perl_D.5.8.3.B_HP-UX_B.11.11_32+64.depot http://software.hp.com/ HP-UX 11i v1.0409 (IA, PA) PERL 5.8.0 - Instalar perl_D.5.8.0.G_HP-UX_B.11.23_IA+PA.depot PERL 5.8.2 - Instalar perl_D.5.8.2.F_HP-UX_B.11.23_IA+PA.depot PERL 5.8.3 - Instalar perl_D.5.8.3.B_HP-UX_B.11.23_IA+PA.depot http://software.hp.com/ Red Hat Red Hat Desktop (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Desktop (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Desktop (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm Red Hat Enterprise Linux AS (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Enterprise Linux AS (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Enterprise Linux AS (v. 4) / IA-64 perl-5.8.5-16.RHEL4.ia64.rpm perl-suidperl-5.8.5-16.RHEL4.ia64.rpm Red Hat Enterprise Linux AS (v. 4) / PPC perl-5.8.5-16.RHEL4.ppc.rpm perl-suidperl-5.8.5-16.RHEL4.ppc.rpm Red Hat Enterprise Linux AS (v. 4) / s390 perl-5.8.5-16.RHEL4.s390.rpm perl-suidperl-5.8.5-16.RHEL4.s390.rpm Red Hat Enterprise Linux AS (v. 4) / s390x perl-5.8.5-16.RHEL4.s390x.rpm perl-suidperl-5.8.5-16.RHEL4.s390x.rpm Red Hat Enterprise Linux AS (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm Red Hat Enterprise Linux ES (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Enterprise Linux ES (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Enterprise Linux ES (v. 4) / IA-64 perl-5.8.5-16.RHEL4.ia64.rpm perl-suidperl-5.8.5-16.RHEL4.ia64.rpm Red Hat Enterprise Linux ES (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm Red Hat Enterprise Linux WS (v. 4) / SRPMS perl-5.8.5-16.RHEL4.src.rpm Red Hat Enterprise Linux WS (v. 4) / IA-32 perl-5.8.5-16.RHEL4.i386.rpm perl-suidperl-5.8.5-16.RHEL4.i386.rpm Red Hat Enterprise Linux WS (v. 4) / IA-64 perl-5.8.5-16.RHEL4.ia64.rpm perl-suidperl-5.8.5-16.RHEL4.ia64.rpm Red Hat Enterprise Linux WS (v. 4) / x86_64 perl-5.8.5-16.RHEL4.x86_64.rpm perl-suidperl-5.8.5-16.RHEL4.x86_64.rpm SGI Advanced Linux Environment 3 / RPM / Patch 10258 ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS Advanced Linux Environment 3 / SRPM / Patch 10258 ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS |
|
Identificadores estándar |
|
| Propiedad | Valor |
| CVE | CAN-2005-0448 |
| BID | |
Recursos adicionales |
|
|
Debian Security Advisory DSA 696-1 http://lists.debian.org/debian-security-announce/debian-security-announce-2005/msg00076.html Mandriva Security Advisories MDKSA-2005:079 http://www.mandriva.com/security/advisories?name=MDKSA-2005:079 HP SECURITY BULLETIN HPSBUX01208 http://www5.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01208 Red Hat Security Advisory (RHSA-2005:674-10) https://rhn.redhat.com/errata/RHSA-2005-674.html SGI Security Advisory (20060101-01-U) ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U.asc |
|
Histórico de versiones |
||
| Versión | Comentario | Fecha |
| 1.0 | Aviso emitido | 2005-03-23 |
| 1.1 | Aviso emitido por Mandriva (MDKSA-2005:079) | 2005-05-02 |
| 1.2 | Aviso emitido por HP (HPSBUX01208) | 2005-06-17 |
| 1.3 | Aviso emitido por Red Hat (RHSA-2005:674-10) | 2005-10-17 |
| 1.4 | Aviso emitido por SGI (20060101-01-U) | 2006-01-19 |