topic Re: Perl Security Vulnerability in Operating System - HP-UX

Perl Security Vulnerability

moonchild — Mon, 26 Jan 2009 17:18:35 GMT

I am researching a security vulnerability found in HP-UX’s Perl. I’ve looked all over HP’s site and cannot find an update or even an acknowledgment of this issue. Any ideas?

Here’s more info:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5303

Thanks.

Re: Perl Security Vulnerability

Avinash20 — Mon, 26 Jan 2009 17:40:36 GMT

Hi,

Is this releated to HP-UX Perl ??

Re: Perl Security Vulnerability

James R. Ferguson — Mon, 26 Jan 2009 17:41:20 GMT

Hi:

A more update (secure) version is available from CPAN:

http://search.cpan.org/~dland/File-Path-2.07/Path.pm

See the notes in the Security Considerations section.

Regards!

...JRF...

Re: Perl Security Vulnerability

Avinash20 — Mon, 26 Jan 2009 17:50:19 GMT

http://securitytracker.com/alerts/2005/Jun/1014213.html

Re: Perl Security Vulnerability

moonchild — Mon, 26 Jan 2009 18:09:47 GMT

Yes this is related to HPUX's PERL

Re: Perl Security Vulnerability

James R. Ferguson — Mon, 26 Jan 2009 18:15:37 GMT

Hi (again):

As I suggested, you can download a newer version of the module from CPAN and install that.

Regards!

...JRF...

Re: Perl Security Vulnerability

moonchild — Mon, 26 Jan 2009 20:02:27 GMT

but this a different one:

Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to allows local users to delete arbitrary files via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5302 due to affected versions.

and am looking to see if HP has new patched perl version?

Re: Perl Security Vulnerability

James R. Ferguson — Mon, 26 Jan 2009 21:21:04 GMT

Hi (again):

> and am looking to see if HP has new patched perl version?

It isn't HP that is going to patch this. This is a Perl community "issue" and would probably be addressed by the module's maintainer. You can query:

http://rt.cpan.org/Public/Dist/Display.html?Name=File-Path

Regards!

...JRF...