CPAN 'Proc::Daemon' Module Insecure File Permissions Vulnerability

Bugtraq ID:	64372
Class:	Design Error
CVE:	CVE-2013-7135
Remote:	No
Local:	Yes
Published:	Dec 16 2013 12:00AM
Updated:	Apr 13 2015 10:00PM
Credit:	Christian mock
Vulnerable:	Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 CPAN Proc::Daemon 0.14-1
Not Vulnerable:	CPAN Proc::Daemon 0.14-2

CPAN 'Proc::Daemon' Module Insecure File Permissions Vulnerability

Proc::Daemon is prone to an insecure file-permission vulnerability.

A local attacker can exploit this issue to obtain potentially sensitive information and overwrite certain files. Information obtained may aid in further attacks

Proc::Daemon 0.14-1 is vulnerable; other versions may also be affected.

CPAN 'Proc::Daemon' Module Insecure File Permissions Vulnerability

Attackers can use readily available tools and standard commands to exploit this issue.

CPAN 'Proc::Daemon' Module Insecure File Permissions Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva perl-Proc-Daemon-0.140.0-2.1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva perl-Proc-Daemon-0.03-5.1mdvmes5.2.noarch.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva perl-Proc-Daemon-0.03-5.1mdvmes5.2.noarch.rpm
  http://www.mandriva.com/en/downloads/

CPAN 'Proc::Daemon' Module Insecure File Permissions Vulnerability

References:

• CVE Request: Proc::Daemon writes pidfile with mode 666 (Salvatore Bonaccorso)
  
• Debian Bug report logs - #732283 libproc-daemon-perl: Writes pidfile with mode 6 (christian mock)
  
• Debian Homepage (Debian)