https://bugzilla.redhat.com/show_bug.cgi?id=1354386
Bug ID: 1354386
Summary: CVE-2016-6185 perl: XSLoader loads relative paths not
included in @INC
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: cweyl(a)alumni.drew.edu, hhorak(a)redhat.com,
iarnell(a)gmail.com, jorton(a)redhat.com,
jplesnik(a)redhat.com, kasal(a)ucw.cz,
perl-devel(a)lists.fedoraproject.org,
perl-maint-list(a)redhat.com, ppisar(a)redhat.com,
psabata(a)redhat.com, rc040203(a)freenet.de,
rmeggins(a)redhat.com, tcallawa(a)redhat.com
An arbitrary code execution can be achieved if loading code from untrusted
current working directory despite the '.' is removed from @INC. Vulnerability
is in XSLoader that uses caller() information to locate .so file to load. If
malicious attacker creates directory named `(eval 1)` with malicious binary
file in it, it will be loaded if the package calling XSLoader is in parent
directory.
CVE assignment:
http://seclists.org/oss-sec/2016/q3/28
Upstream bug:
https://rt.cpan.org/Public/Bug/Display.html?id=115808
Upstream patch:
http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7
--
You are receiving this mail because:
You are on the CC list for the bug.