 |
with SecurityTracker! | |
|
|
with SecurityTracker! | |
| Home | View Topics | Search | |
|
|
| Category: Application (Generic) > Perl | Vendors: Wall, Larry |
|
Perl rmtree() Function Lets Local Users Gain Elevated Privileges
|
| SecurityTracker Alert ID: 1020373 |
| SecurityTracker URL: https://securitytracker.com/id/1020373 |
| CVE Reference: CVE-2008-2827 (Links to External Site) |
|
Date: Jun 27 2008
|
|
Impact:
Root access via local system |
|
Vendor Confirmed: Yes Exploit Included: Yes |
|
Version(s): 5.10.0 |
|
Description:
A vulnerability was reported in Perl. A local user can obtain elevated privileges on the target system. The rmtree() function in 'lib/File/Path.pm' does not properly manage permissions on symbolic links (symlinks). The function changes the permissions of the symlink target to the permissions of the symlink, which may be world-writable and world-readable permissions. A local user can exploit this to obtain root privileges on the target system. The vendor's bug report is available at: http://rt.cpan.org/Public/Bug/Display.html?id=36982 Ben Hutchings reported this vulnerability. |
|
Impact:
A local user can obtain root privileges on the target system. |
|
Solution:
No solution was available at the time of this entry. |
|
Vendor URL: cpan.org/ (Links to External Site)
|
|
Cause:
Access control error |
| Underlying OS: Linux (Any), UNIX (Any), Windows (Any) |
|
|
|
Message History:
None.
|
Source Message Contents |
|