Perl SuidPerl Multiple Local Vulnerabilities

BID:12426

Info

Perl SuidPerl Multiple Local Vulnerabilities

Bugtraq ID: 12426
Class: Unknown
CVE: CVE-2005-0155
CVE-2005-0156
CVE-2006-3813
Remote: No
Local: Yes
Published: Feb 02 2005 12:00AM
Updated: Sep 26 2013 12:16AM
Credit: These vulnerabilities were announced in a vendor advisory.
Vulnerable: Ubuntu Ubuntu Linux 4.1 ppc
Ubuntu Ubuntu Linux 4.1 ia64
Ubuntu Ubuntu Linux 4.1 ia32
Trustix Secure Linux 2.2
Trustix Secure Linux 2.1
Trustix Secure Linux 1.5
Trustix Secure Enterprise Linux 2.0
SGI ProPack 3.0
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
S.u.S.E. Linux 8.1
S.u.S.E. Linux 8.0 i386
S.u.S.E. Linux 8.0
RedHat Linux 9.0 i386
RedHat Linux 7.3 i386
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Desktop 4.0
RedHat Desktop 3.0
Red Hat Fedora Core3
Red Hat Fedora Core2
Red Hat Fedora Core1
Red Hat Enterprise Linux AS 4
Red Hat Enterprise Linux AS 3
Larry Wall Perl 5.8.4 -5
Larry Wall Perl 5.8.4 -4
Larry Wall Perl 5.8.4 -3
Larry Wall Perl 5.8.4 -2.3
Larry Wall Perl 5.8.4 -2
Larry Wall Perl 5.8.4 -1
Larry Wall Perl 5.8.4
+ MandrakeSoft Corporate Server 3.0 x86_64
 + MandrakeSoft Corporate Server 3.0
+ MandrakeSoft Corporate Server 2.1 x86_64
 + MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 10.1 x86_64
 + Mandriva Linux Mandrake 10.1
+ Mandriva Linux Mandrake 10.0 AMD64
 + Mandriva Linux Mandrake 10.0
+ Mandriva Linux Mandrake 9.2 amd64
 + Mandriva Linux Mandrake 9.2
Larry Wall Perl 5.8.3
+ Gentoo Linux
+ Trustix Secure Linux 2.1
+ Trustix Secure Linux 2.0
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
 Larry Wall Perl 5.8.1
Larry Wall Perl 5.8
+ Turbolinux Home
+ Turbolinux Turbolinux Desktop 10.0
IBM AIX 5.3
IBM AIX 5.2
Conectiva Linux 10.0
Avaya Messaging Storage Server MM3.0
Not Vulnerable:

Discussion

Perl SuidPerl Multiple Local Vulnerabilities

SuidPerl is reported prone to multiple vulnerabilities. The following individual issues are reported:

- the 'PERLIO_DEBUG' SuidPerl environment variable may be employed to corrupt arbitrary files. A local unprivileged attacker may exploit this vulnerability to corrupt arbitrary files with superuser privileges. This may ultimately lead to a denial of service for legitimate users or to privilege escalation.

- SuidPerl is prone to a local buffer-overflow vulnerability as well. A local attacker may exploit this buffer-overflow vulnerability to gain superuser privileges. This issue is also exploited through the 'PERLIO_DEBUG' variable.

Exploit / POC

Perl SuidPerl Multiple Local Vulnerabilities

Kevin Finisterre <[email protected]> has provided the following proof-of-concept exploits:

Solution / Fix

Perl SuidPerl Multiple Local Vulnerabilities

Solution:
Please see the referenced advisories for more information.


IBM AIX 5.2

IBM AIX 5.3

SGI ProPack 3.0

Larry Wall Perl 5.8

Larry Wall Perl 5.8.1

Larry Wall Perl 5.8.3

Larry Wall Perl 5.8.4

Larry Wall Perl 5.8.4 -5

References

© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report