 |
with SecurityTracker! | |
|
|
with SecurityTracker! | |
| Home | View Topics | Search | |
|
|
| Category: Application (Generic) > Perl | Vendors: Wall, Larry |
|
(Ubuntu Issues Fix) Perl PathTools Bug in File::Spec Module Lets Remote Users Bypass Taint Restrictions on the Target System
| ||
| SecurityTracker Alert ID: 1034773 | ||
| SecurityTracker URL: https://securitytracker.com/id/1034773 | ||
| CVE Reference: CVE-2015-8607 (Links to External Site) | ||
|
Date: Jan 21 2016
| ||
|
Impact:
Modification of system information | ||
|
Fix Available: Yes Vendor Confirmed: Yes | ||
|
| ||
|
Description:
A vulnerability was reported in Perl. A remote user can bypass security controls on the target system. The File::Spec::canonpath() in PathTools does not preserve the taint attribute. A user may be able to create a specially crafted value to bypass the taint protection mechanism. PathTools is included in Perl. David Golden reported this vulnerability. | ||
|
Impact:
A remote user may be able to bypass the taint protection mechanism. | ||
|
Solution:
Ubuntu has issued a fix. The Ubuntu advisory is available at: http://www.ubuntu.com/usn/usn-2878-1 | ||
|
Vendor URL: www.ubuntu.com/usn/usn-2878-1 (Links to External Site)
| ||
|
Cause:
Access control error | ||
| Underlying OS: Linux (Ubuntu) | ||
| Underlying OS Comments: 15.04, 15.10 | ||
|
| ||
Message History:
This archive entry is a follow-up to the message listed below.
| ||
Source Message Contents | ||
| ||