LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: November 21st, 2014
Linux Security Week: November 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
RedHat: perl XSS vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by LinuxSecurity.com Team   
RedHat Linux Updated Perl packages that fix a security issue in Safe.pm and a cross-sitescripting (XSS) vulnerability in CGI.pm are now available.

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Updated Perl packages fix security issues.
Advisory ID:       RHSA-2003:256-02
Issue date:        2003-09-22
Updated on:        2003-10-03
Product:           Red Hat Linux
Keywords:          Safe.pm CGI.pm
Cross references:  
Obsoletes:         RHBA-2002:023
CVE Names:         CAN-2002-1323 CAN-2003-0615
- ---------------------------------------------------------------------

1. Topic:

Updated Perl packages that fix a security issue in Safe.pm and a cross-site
scripting (XSS) vulnerability in CGI.pm are now available.

[Updated 3 Oct 2003]
Added updated mod_perl packages for Red Hat Linux 7.1, which are required
due to the move to Perl version 5.6.1 on this platform.

2. Relevant releases/architectures:

Red Hat Linux 7.1 - i386
Red Hat Linux 7.1 for iSeries (64 bit) - ppc
Red Hat Linux 7.1 for pSeries (64 bit) - ppc
Red Hat Linux 7.2 - i386, ia64
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386
Red Hat Linux 9 - i386

3. Problem description:

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

Two security issues have been found in Perl that affect the Perl packages
shipped with Red Hat Linux:

When safe.pm versions 2.0.7 and earlier are used with Perl 5.8.0 and
earlier, it is possible for an attacker to break out of safe compartments
within Safe::reval and Safe::rdo by using a redefined @_ variable. This is
due to the fact that the redefined @_ variable is not reset between
successive calls. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1323 to this issue. NOTE:
This issue does not affect the Perl packages which shipped with Red Hat
Linux 9.

A cross-site scripting vulnerability was discovered in the start_form()
function of CGI.pm. The vulnerability allows a remote attacker to insert a
Web script via a URL fed into the form's action parameter. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0615 to this issue.

Users of Perl are advised to upgrade to the packages contained within this
erratum. For Red Hat Linux 7.1, 7.2, and 7.3, Perl version 5.6.1 contains
backported security patches addressing these issues. For Red Hat Linux 8.0
and 9, Perl version 5.8.0 is supplied, which is not vulnerable to issue
CAN-2003-1323 and which contains a backported security patch addressing
issue CAN-2003-0615.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL Certificate 
Errors, you need to install a version of the up2date client with an updated 
certificate.  The latest version of up2date is available from the Red Hat 
FTP site and may also be downloaded directly from the RHN website:

https://rhn.Red Hat.com/help/latest-up2date.pxt

5. Bug IDs fixed  (http://bugzilla.Red Hat.com/bugzilla for more info):

104875 - Latest Perl errata upgrades RH7.1 to 5.6.1 from 5.6.0 and breaks dependencies

6. RPMs required:

Red Hat Linux 7.1:

SRPMS: 
ftp://updates.Red Hat.com/7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm 
ftp://updates.Red Hat.com/7.1/en/os/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm

i386: 
ftp://updates.Red Hat.com/7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm 
ftp://updates.Red Hat.com/7.1/en/os/i386/mod_perl-1.24_01-2.71.2.i386.rpm

Red Hat Linux 7.1 for iSeries (64 bit):

SRPMS: 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm

ppc: 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/iSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm

Red Hat Linux 7.1 for pSeries (64 bit):

SRPMS: 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm

ppc: 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm 
ftp://updates.Red Hat.com/7.1/en/os/pSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm

Red Hat Linux 7.2:

SRPMS: 
ftp://updates.Red Hat.com/7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm

i386: 
ftp://updates.Red Hat.com/7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm 
ftp://updates.Red Hat.com/7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm 
ftp://updates.Red Hat.com/7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm 
ftp://updates.Red Hat.com/7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm 
ftp://updates.Red Hat.com/7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm 
ftp://updates.Red Hat.com/7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm

ia64: 
ftp://updates.Red Hat.com/7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm 
ftp://updates.Red Hat.com/7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm 
ftp://updates.Red Hat.com/7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm 
ftp://updates.Red Hat.com/7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm 
ftp://updates.Red Hat.com/7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm 
ftp://updates.Red Hat.com/7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm

Red Hat Linux 7.3:

SRPMS: 
ftp://updates.Red Hat.com/7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm

i386: 
ftp://updates.Red Hat.com/7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm 
ftp://updates.Red Hat.com/7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm 
ftp://updates.Red Hat.com/7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm 
ftp://updates.Red Hat.com/7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm 
ftp://updates.Red Hat.com/7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm 
ftp://updates.Red Hat.com/7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm

Red Hat Linux 8.0:

SRPMS: 
ftp://updates.Red Hat.com/8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm

i386: 
ftp://updates.Red Hat.com/8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm 
ftp://updates.Red Hat.com/8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm 
ftp://updates.Red Hat.com/8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm 
ftp://updates.Red Hat.com/8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm 
ftp://updates.Red Hat.com/8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm

Red Hat Linux 9:

SRPMS: 
ftp://updates.Red Hat.com/9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm

i386: 
ftp://updates.Red Hat.com/9/en/os/i386/perl-5.8.0-88.3.i386.rpm 
ftp://updates.Red Hat.com/9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm 
ftp://updates.Red Hat.com/9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm 
ftp://updates.Red Hat.com/9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm 
ftp://updates.Red Hat.com/9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm



7. Verification:

MD5 sum                          Package Name
- --------------------------------------------------------------------------
00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm
5cd594b4624d5e978ed19bc30e9fe4ed 7.1/en/os/i386/mod_perl-1.24_01-2.71.2.i386.rpm
4e5c17ee59c6f42095eb320c8d0904bd 7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm
484f2c937595632e9531b4032e29f50e 7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm
dfc42b708073a61c3d9f9f9b5c1f7959 7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm
60c0cabb19f411bcd427b7c683b44536 7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm
6c3bd193de0b1c8d19ca93838e089078 7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm
ab6f508cd17923a23f64fa73c58d523f 7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm
00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/iSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm
2fb2e0a065a0239f7bd768dd025c4f67 7.1/en/os/iSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm
b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm
9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
3149414b45944023821923206640bbda 7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
98aad53e528f30a469718504f82e820e 7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
0465a61f126fc211977f14f04b36b798 7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/pSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm
2fb2e0a065a0239f7bd768dd025c4f67 7.1/en/os/pSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm
b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm
9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
3149414b45944023821923206640bbda 7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
98aad53e528f30a469718504f82e820e 7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
0465a61f126fc211977f14f04b36b798 7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
e535d85774a13510bef89bd78b6b216f 7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm
03ab6415d69d4a102fe234f4b9f22748 7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm
d585c9e8a58b09b3e5d4f87f1000db36 7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm
533d11a6fbc56f584aa5cd45a7dde8dd 7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm
ea118d193a1d788bc76917aaed12f111 7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm
bd85a685357c7c9e06334120bd525915 7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm
1cd65737a2adb8aff508f4d17d3608c8 7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm
01e342dd72f0d8aeacd1facfac2534a2 7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm
b91893cb70d3fd4e3283891194747cf0 7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm
b5d9998614b01d5238db888b4fddcc9b 7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm
6c91069b1f3128a05a4e7a0250227028 7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm
2f393ca8ddcd822e863d93ab5e4a1bb2 7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm
72af18dbe6f4667f7a726517b15c1f1a 7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm
7b137d76ed95cbf9eecc9d660417b7ed 7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm
9a4fa98a57ff3b322ba18d9f0bb1864f 7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm
9878354d09a308efcbfe00fd6e7665d6 7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm
ef7af3445fc8c7071febd7fd27a61b45 7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm
79f963a7050fa706fe684b5e33923fa9 7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm
30119242d86c4980cb60d03a0520c5e0 7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm
d169d03e8992fb0b016685522aa20dc9 7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm
e27cfe1c0bc442ce7ebd12928479134e 8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm
0ac800e33acab6522169d72dac29721b 8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm
cc53faea268b17b68d1494e9cd4d442b 8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm
fb2a95814dbefd3a0d5f776f6bc47a27 8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm
abc1c47518fda72936a247d93a175fe4 8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm
69bc3cf938b5b0e6ad2657ceda85d19b 8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm
e27cfe1c0bc442ce7ebd12928479134e 9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm
0ac800e33acab6522169d72dac29721b 9/en/os/i386/perl-5.8.0-88.3.i386.rpm
cc53faea268b17b68d1494e9cd4d442b 9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm
fb2a95814dbefd3a0d5f776f6bc47a27 9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm
abc1c47518fda72936a247d93a175fe4 9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm
69bc3cf938b5b0e6ad2657ceda85d19b 9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm


These packages are GPG signed by Red Hat for security.  Our key is
available from https://www.Red Hat.com/security/keys.html

You can verify each package with the following command:
    
    rpm --checksig -v 

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    
    md5sum 


8. References:
 
http://marc.theaimsgroup.com/?l=bugtraq&m=105880349328877 
http://bugs6.perl.org/rt2/Ticket/Display.html?id=17744 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1323 
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0615

9. Contact:

The Red Hat security contact is <secalert@Red Hat.com>.  More contact
details at https://www.Red Hat.com/solutions/security/news/contact.html

Copyright 2003 Red Hat, Inc.

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
Google Releases Open Source Tool for Testing Web App Security Scanners
Most Targeted Attacks Exploit Privileged Accounts
NotCompable sets new standards for mobile botnet sophistication
Hands on with Caine Linux: Pentesting and UEFI compatible
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.