Bezpečnostní zprávy Debianu
DSA-620-1 perl -- nespolehlivé dočasné soubory / adresáře
- Datum oznámění:
- 30.12.2004
- Zasažené balíčky:
- perl
- Zranitelný:
- Ano
- Odkazy na bezpečnostní databázi:
- In Mitre's CVE dictionary: CVE-2004-0452, CVE-2004-0976.
- Více informací:
-
Bylo objeveno několik zranitelností v Perlu, populárním skriptovacím jazyce. Projekt Common Vulnerabilities and Exposures zjistil následující problémy:
- CAN-2004-0452
Jeroen van Wolffelaar zjistil, že funkce rmtree() v modulu File::Path odstraňuje adresářové stromy nebezpečným způsobem, který může vést ke smazání libovolných souborů a adresářů pomocí útoku symbolickým odkazem.
- CAN-2004-0976
Vývojáři Trustix objevili několik nebezpečných použití dočasných souborů v mnoha modulech, které dovolují lokálnímu útočníkovi přepsat soubory pomocí útoku symbolickým odkazem.
Pro stable distribuci (woody) byly tyto problémy opraveny ve verzi 5.6.1-8.8.
Pro unstable distribuci (sid) byly tyto problémy opraveny ve verzi 5.8.4-5.
Doporučujeme vám aktualizovat vaše perl balíčky.
- CAN-2004-0452
- Opraveno v:
-
Debian GNU/Linux 3.0 (woody)
- Zdroj:
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8.dsc
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8.diff.gz
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1.orig.tar.gz
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8.diff.gz
- Část nezávislá na architektuře:
- http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.6.1-8.8_all.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.6.1-8.8_all.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.6.1-8.8_all.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.6.1-8.8_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_alpha.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_alpha.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_alpha.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_alpha.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_alpha.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_alpha.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_arm.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_arm.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_arm.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_arm.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_arm.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_arm.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_i386.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_i386.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_i386.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_i386.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_i386.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_i386.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_ia64.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_ia64.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_ia64.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_ia64.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_ia64.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_ia64.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_hppa.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_hppa.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_hppa.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_hppa.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_hppa.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_hppa.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_m68k.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_m68k.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_m68k.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_m68k.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_m68k.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_m68k.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_mips.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_mips.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_mips.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_mips.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_mips.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_mips.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_mipsel.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_mipsel.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_mipsel.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_mipsel.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_mipsel.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_mipsel.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_powerpc.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_powerpc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_powerpc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_powerpc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_powerpc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_powerpc.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_s390.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_s390.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_s390.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_s390.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_s390.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_s390.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.8_sparc.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_sparc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.8_sparc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.8_sparc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.8_sparc.deb
- http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.8_sparc.deb
- http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.8_sparc.deb
MD5 kontrolní součty (checksums) uvedených souborů jsou dostupné v původní zprávě.