From bugzilla@redhat.com Fri Oct 3 18:46:36 2003 From: bugzilla@redhat.com To: redhat-watch-list@redhat.com, bugtraq@securityfocus.com, full-disclosure@lists.netsys.com Date: Fri, 3 Oct 2003 10:33 -0400 Subject: [RHSA-2003:256-02] Updated Perl packages fix security issues. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated Perl packages fix security issues. Advisory ID: RHSA-2003:256-02 Issue date: 2003-09-22 Updated on: 2003-10-03 Product: Red Hat Linux Keywords: Safe.pm CGI.pm Cross references: Obsoletes: RHBA-2002:023 CVE Names: CAN-2002-1323 CAN-2003-0615 - --------------------------------------------------------------------- 1. Topic: Updated Perl packages that fix a security issue in Safe.pm and a cross-site scripting (XSS) vulnerability in CGI.pm are now available. [Updated 3 Oct 2003] Added updated mod_perl packages for Red Hat Linux 7.1, which are required due to the move to Perl version 5.6.1 on this platform. 2. Relevant releases/architectures: Red Hat Linux 7.1 - i386 Red Hat Linux 7.1 for iSeries (64 bit) - ppc Red Hat Linux 7.1 for pSeries (64 bit) - ppc Red Hat Linux 7.2 - i386, ia64 Red Hat Linux 7.3 - i386 Red Hat Linux 8.0 - i386 Red Hat Linux 9 - i386 3. Problem description: Perl is a high-level programming language commonly used for system administration utilities and Web programming. Two security issues have been found in Perl that affect the Perl packages shipped with Red Hat Linux: When safe.pm versions 2.0.7 and earlier are used with Perl 5.8.0 and earlier, it is possible for an attacker to break out of safe compartments within Safe::reval and Safe::rdo by using a redefined @_ variable. This is due to the fact that the redefined @_ variable is not reset between successive calls. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1323 to this issue. NOTE: This issue does not affect the Perl packages which shipped with Red Hat Linux 9. A cross-site scripting vulnerability was discovered in the start_form() function of CGI.pm. The vulnerability allows a remote attacker to insert a Web script via a URL fed into the form's action parameter. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0615 to this issue. Users of Perl are advised to upgrade to the packages contained within this erratum. For Red Hat Linux 7.1, 7.2, and 7.3, Perl version 5.6.1 contains backported security patches addressing these issues. For Red Hat Linux 8.0 and 9, Perl version 5.8.0 is supplied, which is not vulnerable to issue CAN-2003-1323 and which contains a backported security patch addressing issue CAN-2003-0615. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. If up2date fails to connect to Red Hat Network due to SSL Certificate Errors, you need to install a version of the up2date client with an updated certificate. The latest version of up2date is available from the Red Hat FTP site and may also be downloaded directly from the RHN website: https://rhn.redhat.com/help/latest-up2date.pxt 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 104875 - Latest Perl errata upgrades RH7.1 to 5.6.1 from 5.6.0 and breaks dependencies 6. RPMs required: Red Hat Linux 7.1: SRPMS: ftp://updates.redhat.com/7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm ftp://updates.redhat.com/7.1/en/os/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm i386: ftp://updates.redhat.com/7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/mod_perl-1.24_01-2.71.2.i386.rpm Red Hat Linux 7.1 for iSeries (64 bit): SRPMS: ftp://updates.redhat.com/7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm ppc: ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm Red Hat Linux 7.1 for pSeries (64 bit): SRPMS: ftp://updates.redhat.com/7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm ppc: ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm Red Hat Linux 7.2: SRPMS: ftp://updates.redhat.com/7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm i386: ftp://updates.redhat.com/7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm ftp://updates.redhat.com/7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm ia64: ftp://updates.redhat.com/7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm ftp://updates.redhat.com/7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm Red Hat Linux 7.3: SRPMS: ftp://updates.redhat.com/7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm i386: ftp://updates.redhat.com/7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm ftp://updates.redhat.com/7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm Red Hat Linux 8.0: SRPMS: ftp://updates.redhat.com/8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm i386: ftp://updates.redhat.com/8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm ftp://updates.redhat.com/8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm Red Hat Linux 9: SRPMS: ftp://updates.redhat.com/9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm i386: ftp://updates.redhat.com/9/en/os/i386/perl-5.8.0-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm ftp://updates.redhat.com/9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm 7. Verification: MD5 sum Package Name - -------------------------------------------------------------------------- 00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm 0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm 5cd594b4624d5e978ed19bc30e9fe4ed 7.1/en/os/i386/mod_perl-1.24_01-2.71.2.i386.rpm 4e5c17ee59c6f42095eb320c8d0904bd 7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm 484f2c937595632e9531b4032e29f50e 7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm dfc42b708073a61c3d9f9f9b5c1f7959 7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm 60c0cabb19f411bcd427b7c683b44536 7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm 6c3bd193de0b1c8d19ca93838e089078 7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm ab6f508cd17923a23f64fa73c58d523f 7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm 00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/iSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm 0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm 2fb2e0a065a0239f7bd768dd025c4f67 7.1/en/os/iSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm 9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm 3149414b45944023821923206640bbda 7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm 697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm 98aad53e528f30a469718504f82e820e 7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm 0465a61f126fc211977f14f04b36b798 7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm 00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/pSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm 0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm 2fb2e0a065a0239f7bd768dd025c4f67 7.1/en/os/pSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm 9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm 3149414b45944023821923206640bbda 7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm 697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm 98aad53e528f30a469718504f82e820e 7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm 0465a61f126fc211977f14f04b36b798 7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm e535d85774a13510bef89bd78b6b216f 7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm 03ab6415d69d4a102fe234f4b9f22748 7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm d585c9e8a58b09b3e5d4f87f1000db36 7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm 533d11a6fbc56f584aa5cd45a7dde8dd 7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm ea118d193a1d788bc76917aaed12f111 7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm bd85a685357c7c9e06334120bd525915 7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm 1cd65737a2adb8aff508f4d17d3608c8 7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm 01e342dd72f0d8aeacd1facfac2534a2 7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm b91893cb70d3fd4e3283891194747cf0 7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm b5d9998614b01d5238db888b4fddcc9b 7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm 6c91069b1f3128a05a4e7a0250227028 7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm 2f393ca8ddcd822e863d93ab5e4a1bb2 7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm 72af18dbe6f4667f7a726517b15c1f1a 7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm 7b137d76ed95cbf9eecc9d660417b7ed 7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm 9a4fa98a57ff3b322ba18d9f0bb1864f 7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm 9878354d09a308efcbfe00fd6e7665d6 7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm ef7af3445fc8c7071febd7fd27a61b45 7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm 79f963a7050fa706fe684b5e33923fa9 7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm 30119242d86c4980cb60d03a0520c5e0 7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm d169d03e8992fb0b016685522aa20dc9 7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm e27cfe1c0bc442ce7ebd12928479134e 8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm 0ac800e33acab6522169d72dac29721b 8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm cc53faea268b17b68d1494e9cd4d442b 8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm fb2a95814dbefd3a0d5f776f6bc47a27 8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm abc1c47518fda72936a247d93a175fe4 8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm 69bc3cf938b5b0e6ad2657ceda85d19b 8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm e27cfe1c0bc442ce7ebd12928479134e 9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm 0ac800e33acab6522169d72dac29721b 9/en/os/i386/perl-5.8.0-88.3.i386.rpm cc53faea268b17b68d1494e9cd4d442b 9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm fb2a95814dbefd3a0d5f776f6bc47a27 9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm abc1c47518fda72936a247d93a175fe4 9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm 69bc3cf938b5b0e6ad2657ceda85d19b 9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm These packages are GPG signed by Red Hat for security. Our key is available from https://www.redhat.com/security/keys.html You can verify each package with the following command: rpm --checksig -v If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum 8. References: http://marc.theaimsgroup.com/?l=bugtraq&m=105880349328877 http://bugs6.perl.org/rt2/Ticket/Display.html?id=17744 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1323 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0615 9. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/solutions/security/news/contact.html Copyright 2003 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE/fYiTXlSAg2UNWIIRAr3jAKC3Rt7Rq1MFYgqCfeocSZlyLJO0xwCfdMQj Cdd1OhMfYDZVMygsDsGN0W0= =RuwD -----END PGP SIGNATURE-----