- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Important: perl security update
Advisory ID:       RHSA-2005:103-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2005:103.html
Issue date:        2005-02-15
Updated on:        2005-02-15
Product:           Red Hat Enterprise Linux
CVE Names:         CAN-2004-0452 CAN-2005-0155 CAN-2005-0156
- ---------------------------------------------------------------------1. Summary:

Updated Perl packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

Kevin Finisterre discovered a stack based buffer overflow flaw in sperl,
the Perl setuid wrapper. A local user could create a sperl executable
script with a carefully created path name, overflowing the buffer and
leading to root privilege escalation.  The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0156 to
this issue.

Kevin Finisterre discovered a flaw in sperl which can cause debugging
information to be logged to arbitrary files.  By setting an environment
variable, a local user could cause sperl to create, as root, files with
arbitrary filenames, or append the debugging information to existing files.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0155 to this issue.

An unsafe file permission bug was discovered in the rmtree() function in
the File::Path module.  The rmtree() function removes files and directories
in an insecure manner, which could allow a local user to read or delete
arbitrary files. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0452 to this issue.

Users of Perl are advised to upgrade to this updated package, which
contains backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

146774 - CAN-2004-0452 File::Path::rmtree() issue
146739 - CAN-2005-0155 multiple setuid perl issues (CAN-2005-0156 )

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
7a96cedf79d1a432017d98dba0d0a942  perl-5.8.5-12.1.src.rpm

i386:
54b5fa19cb57d751ab97f6af23aaa2c8  perl-5.8.5-12.1.i386.rpm
1c2bea7fbcc7314a8d4ef6e1b6740612  perl-suidperl-5.8.5-12.1.1.i386.rpm

ia64:
f62cd1880ef37655fc3f899167506210  perl-5.8.5-12.1.ia64.rpm
f44de9b35fbea3e3008a54af398f9f85  perl-suidperl-5.8.5-12.1.1.ia64.rpm

ppc:
b6f57d5e260d76af9545746834ca11b8  perl-5.8.5-12.1.ppc.rpm
1f1ca5442c04035daa6d3ca39a3aec46  perl-suidperl-5.8.5-12.1.1.ppc.rpm

s390:
bd38a15ca6df61c3dccfd36b04ba6726  perl-5.8.5-12.1.s390.rpm
8cf6fe94b55cc0f549d090eff2011636  perl-suidperl-5.8.5-12.1.1.s390.rpm

s390x:
cc5cf1b33baa869bf1ee4e23e0cc7b35  perl-5.8.5-12.1.s390x.rpm
9f84a323e964c3a451768b739e548fec  perl-suidperl-5.8.5-12.1.1.s390x.rpm

x86_64:
935d0324608cb6929e2cab7a18f0e100  perl-5.8.5-12.1.x86_64.rpm
d9371f44f8d263d1fabe88d55509c43b  perl-suidperl-5.8.5-12.1.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
7a96cedf79d1a432017d98dba0d0a942  perl-5.8.5-12.1.src.rpm

i386:
54b5fa19cb57d751ab97f6af23aaa2c8  perl-5.8.5-12.1.i386.rpm
1c2bea7fbcc7314a8d4ef6e1b6740612  perl-suidperl-5.8.5-12.1.1.i386.rpm

x86_64:
935d0324608cb6929e2cab7a18f0e100  perl-5.8.5-12.1.x86_64.rpm
d9371f44f8d263d1fabe88d55509c43b  perl-suidperl-5.8.5-12.1.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
7a96cedf79d1a432017d98dba0d0a942  perl-5.8.5-12.1.src.rpm

i386:
54b5fa19cb57d751ab97f6af23aaa2c8  perl-5.8.5-12.1.i386.rpm
1c2bea7fbcc7314a8d4ef6e1b6740612  perl-suidperl-5.8.5-12.1.1.i386.rpm

ia64:
f62cd1880ef37655fc3f899167506210  perl-5.8.5-12.1.ia64.rpm
f44de9b35fbea3e3008a54af398f9f85  perl-suidperl-5.8.5-12.1.1.ia64.rpm

x86_64:
935d0324608cb6929e2cab7a18f0e100  perl-5.8.5-12.1.x86_64.rpm
d9371f44f8d263d1fabe88d55509c43b  perl-suidperl-5.8.5-12.1.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
7a96cedf79d1a432017d98dba0d0a942  perl-5.8.5-12.1.src.rpm

i386:
54b5fa19cb57d751ab97f6af23aaa2c8  perl-5.8.5-12.1.i386.rpm
1c2bea7fbcc7314a8d4ef6e1b6740612  perl-suidperl-5.8.5-12.1.1.i386.rpm

ia64:
f62cd1880ef37655fc3f899167506210  perl-5.8.5-12.1.ia64.rpm
f44de9b35fbea3e3008a54af398f9f85  perl-suidperl-5.8.5-12.1.1.ia64.rpm

x86_64:
935d0324608cb6929e2cab7a18f0e100  perl-5.8.5-12.1.x86_64.rpm
d9371f44f8d263d1fabe88d55509c43b  perl-suidperl-5.8.5-12.1.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0452
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0155
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0156

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.