SecurityFocus BUGTRAQ Mailing List: BugTraqLink Number One Link Number One Link Number Two Link Number Two Link Number One Link Number One Link Number Two Link Number Two Entire Site Advisories Calendar Columnists Elsewhere Guest Feature Infocus Library Links Mailing Lists (all) -- BUGTRAQ -- FOCUS-IDS -- FOCUS-IH -- FOCUS-LINUX -- FOCUS-MS -- FOCUS-SUN -- FOCUS-VIRUS -- FORENSICS -- INCIDENTS -- PEN-TEST -- SEC JOBS -- SF NEWS -- VULN-DEV News Products Services Tools Vulns BUGTRAQ ARCHIVE [ Message Index ] [ Thread Index ][ Reply ] [ prev Msg by Date ][ next Msg by Date ] To: BugTraq Subject: [RHSA-2003:256-01] Updated Perl packages fix security issues. Date: Sep 22 2003 8:53AM Author: Message-ID: <200309220853.h8M8rS812256@porkchop.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated Perl packages fix security issues. Advisory ID: RHSA-2003:256-01 Issue date: 2003-09-22 Updated on: 2003-09-22 Product: Red Hat Linux Keywords: Safe.pm CGI.pm Cross references: Obsoletes: RHBA-2002:023 CVE Names: CAN-2002-1323 CAN-2003-0615 - --------------------------------------------------------------------- 1. Topic: Updated Perl packages that fix a security issue in Safe.pm and a cross-site scripting (XSS) vulnerability in CGI.pm are now available. 2. Relevant releases/architectures: Red Hat Linux 7.1 - i386 Red Hat Linux 7.1 for iSeries (64 bit) - ppc Red Hat Linux 7.1 for pSeries (64 bit) - ppc Red Hat Linux 7.2 - i386, ia64 Red Hat Linux 7.3 - i386 Red Hat Linux 8.0 - i386 Red Hat Linux 9 - i386 3. Problem description: Perl is a high-level programming language commonly used for system administration utilities and Web programming. Two security issues have been found in Perl that affect the Perl packages shipped with Red Hat Linux: When safe.pm versions 2.0.7 and earlier are used with Perl 5.8.0 and earlier, it is possible for an attacker to break out of safe compartments within Safe::reval and Safe::rdo by using a redefined @_ variable. This is due to the fact that the redefined @_ variable is not reset between successive calls. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1323 to this issue. NOTE: This issue does not affect the Perl packages which shipped with Red Hat Linux 9. A cross-site scripting vulnerability was discovered in the start_form() function of CGI.pm. The vulnerability allows a remote attacker to insert a Web script via a URL fed into the form's action parameter. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0615 to this issue. Users of Perl are advised to upgrade to the packages contained within this erratum. For Red Hat Linux 7.1, 7.2, and 7.3, Perl version 5.6.1 contains backported security patches addressing these issues. For Red Hat Linux 8.0 and 9, Perl version 5.8.0 is supplied, which is not vulnerable to issue CAN-2003-1323 and which contains a backported security patch addressing issue CAN-2003-0615. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. If up2date fails to connect to Red Hat Network due to SSL Certificate Errors, you need to install a version of the up2date client with an updated certificate. The latest version of up2date is available from the Red Hat FTP site and may also be downloaded directly from the RHN website: https://rhn.redhat.com/help/latest-up2date.pxt 5. RPMs required: Red Hat Linux 7.1: SRPMS: ftp://updates.redhat.com/7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm i386: ftp://updates.redhat.com/7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm Red Hat Linux 7.1 for iSeries (64 bit): SRPMS: ftp://updates.redhat.com/7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm ppc: ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm Red Hat Linux 7.1 for pSeries (64 bit): SRPMS: ftp://updates.redhat.com/7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm ppc: ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm Red Hat Linux 7.2: SRPMS: ftp://updates.redhat.com/7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm i386: ftp://updates.redhat.com/7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm ia64: ftp://updates.redhat.com/7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm Red Hat Linux 7.3: SRPMS: ftp://updates.redhat.com/7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm i386: ftp://updates.redhat.com/7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm Red Hat Linux 8.0: SRPMS: ftp://updates.redhat.com/8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm i386: ftp://updates.redhat.com/8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm Red Hat Linux 9: SRPMS: ftp://updates.redhat.com/9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm i386: ftp://updates.redhat.com/9/en/os/i386/perl-5.8.0-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm 6. Verification: MD5 sum Package Name - -------------------------------------------------------------------------- 0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm 4e5c17ee59c6f42095eb320c8d0904bd 7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm 484f2c937595632e9531b4032e29f50e 7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm dfc42b708073a61c3d9f9f9b5c1f7959 7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm 60c0cabb19f411bcd427b7c683b44536 7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm 6c3bd193de0b1c8d19ca93838e089078 7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm ab6f508cd17923a23f64fa73c58d523f 7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm 0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm 9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm 3149414b45944023821923206640bbda 7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm 697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm 98aad53e528f30a469718504f82e820e 7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm 0465a61f126fc211977f14f04b36b798 7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm 0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm 9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm 3149414b45944023821923206640bbda 7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm 697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm 98aad53e528f30a469718504f82e820e 7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm 0465a61f126fc211977f14f04b36b798 7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm e535d85774a13510bef89bd78b6b216f 7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm 03ab6415d69d4a102fe234f4b9f22748 7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm d585c9e8a58b09b3e5d4f87f1000db36 7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm 533d11a6fbc56f584aa5cd45a7dde8dd 7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm ea118d193a1d788bc76917aaed12f111 7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm bd85a685357c7c9e06334120bd525915 7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm 1cd65737a2adb8aff508f4d17d3608c8 7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm 01e342dd72f0d8aeacd1facfac2534a2 7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm b91893cb70d3fd4e3283891194747cf0 7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm b5d9998614b01d5238db888b4fddcc9b 7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm 6c91069b1f3128a05a4e7a0250227028 7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm 2f393ca8ddcd822e863d93ab5e4a1bb2 7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm 72af18dbe6f4667f7a726517b15c1f1a 7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm 7b137d76ed95cbf9eecc9d660417b7ed 7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm 9a4fa98a57ff3b322ba18d9f0bb1864f 7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm 9878354d09a308efcbfe00fd6e7665d6 7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm ef7af3445fc8c7071febd7fd27a61b45 7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm 79f963a7050fa706fe684b5e33923fa9 7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm 30119242d86c4980cb60d03a0520c5e0 7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm d169d03e8992fb0b016685522aa20dc9 7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm e27cfe1c0bc442ce7ebd12928479134e 8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm 0ac800e33acab6522169d72dac29721b 8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm cc53faea268b17b68d1494e9cd4d442b 8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm fb2a95814dbefd3a0d5f776f6bc47a27 8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm abc1c47518fda72936a247d93a175fe4 8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm 69bc3cf938b5b0e6ad2657ceda85d19b 8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm e27cfe1c0bc442ce7ebd12928479134e 9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm 0ac800e33acab6522169d72dac29721b 9/en/os/i386/perl-5.8.0-88.3.i386.rpm cc53faea268b17b68d1494e9cd4d442b 9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm fb2a95814dbefd3a0d5f776f6bc47a27 9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm abc1c47518fda72936a247d93a175fe4 9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm 69bc3cf938b5b0e6ad2657ceda85d19b 9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm These packages are GPG signed by Red Hat for security. Our key is available from https://www.redhat.com/security/keys.html You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum 7. References: http://marc.theaimsgroup.com/?l=bugtraq&m=105880349328877 http://bugs6.perl.org/rt2/Ticket/Display.html?id=17744 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1323 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0615 8. Contact: The Red Hat security contact is More contact details at https://www.redhat.com/solutions/security/news/contact.html Copyright 2003 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE/briFXlSAg2UNWIIRAqTzAJsG28moRSn4zIAiYf84Ww+PIKBuRQCghokp 4yeMVtStS34Kt04N+40eiKE= =dJ7Y -----END PGP SIGNATURE----- Want to link to this message? Use this URL: Disclaimer, Terms & Conditions About this List Featured Lists: ARIS Users bugtraq bugtraq-es bugtraq-french NEW bugtraq-jp firewalls focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics forensics-es honeypots incidents libnet pen-test secevents secpapers secprog sectools secureshell security-basics security-management NEW securityjobs vpn vuln-dev webappsec Newsletters: sf-news ms-secnews linux-secnews [ more . . . ] Privacy Statement Copyright © 1999-2003 SecurityFocus