Message-ID: <200310031433.h93EXoP04056@porkchop.devel.redhat.com>
Date: Fri, 3 Oct 2003 10:33 -0400
From: bugzilla@...hat.com
To: redhat-watch-list@...hat.com, bugtraq@...urityfocus.com,
   full-disclosure@...ts.netsys.com
Subject: [RHSA-2003:256-02] Updated Perl packages fix security issues.


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Updated Perl packages fix security issues.
Advisory ID:       RHSA-2003:256-02
Issue date:        2003-09-22
Updated on:        2003-10-03
Product:           Red Hat Linux
Keywords:          Safe.pm CGI.pm
Cross references:  
Obsoletes:         RHBA-2002:023
CVE Names:         CAN-2002-1323 CAN-2003-0615
- ---------------------------------------------------------------------

1. Topic:

Updated Perl packages that fix a security issue in Safe.pm and a cross-site
scripting (XSS) vulnerability in CGI.pm are now available.

[Updated 3 Oct 2003]
Added updated mod_perl packages for Red Hat Linux 7.1, which are required
due to the move to Perl version 5.6.1 on this platform.

2. Relevant releases/architectures:

Red Hat Linux 7.1 - i386
Red Hat Linux 7.1 for iSeries (64 bit) - ppc
Red Hat Linux 7.1 for pSeries (64 bit) - ppc
Red Hat Linux 7.2 - i386, ia64
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386
Red Hat Linux 9 - i386

3. Problem description:

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

Two security issues have been found in Perl that affect the Perl packages
shipped with Red Hat Linux:

When safe.pm versions 2.0.7 and earlier are used with Perl 5.8.0 and
earlier, it is possible for an attacker to break out of safe compartments
within Safe::reval and Safe::rdo by using a redefined @_ variable. This is
due to the fact that the redefined @_ variable is not reset between
successive calls. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1323 to this issue. NOTE:
This issue does not affect the Perl packages which shipped with Red Hat
Linux 9.

A cross-site scripting vulnerability was discovered in the start_form()
function of CGI.pm. The vulnerability allows a remote attacker to insert a
Web script via a URL fed into the form's action parameter. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2003-0615 to this issue.

Users of Perl are advised to upgrade to the packages contained within this
erratum. For Red Hat Linux 7.1, 7.2, and 7.3, Perl version 5.6.1 contains
backported security patches addressing these issues. For Red Hat Linux 8.0
and 9, Perl version 5.8.0 is supplied, which is not vulnerable to issue
CAN-2003-1323 and which contains a backported security patch addressing
issue CAN-2003-0615.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL Certificate 
Errors, you need to install a version of the up2date client with an updated 
certificate.  The latest version of up2date is available from the Red Hat 
FTP site and may also be downloaded directly from the RHN website:

https://rhn.redhat.com/help/latest-up2date.pxt

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

104875 - Latest Perl errata upgrades RH7.1 to 5.6.1 from 5.6.0 and breaks dependencies

6. RPMs required:

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm
ftp://updates.redhat.com/7.1/en/os/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/mod_perl-1.24_01-2.71.2.i386.rpm

Red Hat Linux 7.1 for iSeries (64 bit):

SRPMS:
ftp://updates.redhat.com/7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm
ftp://updates.redhat.com/7.1/en/os/iSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm

ppc:
ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/iSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm

Red Hat Linux 7.1 for pSeries (64 bit):

SRPMS:
ftp://updates.redhat.com/7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm
ftp://updates.redhat.com/7.1/en/os/pSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm

ppc:
ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
ftp://updates.redhat.com/7.1/en/os/pSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm

Red Hat Linux 7.3:

SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm

i386:
ftp://updates.redhat.com/7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm

Red Hat Linux 8.0:

SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm

i386:
ftp://updates.redhat.com/8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm

Red Hat Linux 9:

SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm

i386:
ftp://updates.redhat.com/9/en/os/i386/perl-5.8.0-88.3.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm



7. Verification:

MD5 sum                          Package Name
- --------------------------------------------------------------------------
00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/SRPMS/perl-5.6.1-36.1.71.src.rpm
5cd594b4624d5e978ed19bc30e9fe4ed 7.1/en/os/i386/mod_perl-1.24_01-2.71.2.i386.rpm
4e5c17ee59c6f42095eb320c8d0904bd 7.1/en/os/i386/perl-5.6.1-36.1.71.i386.rpm
484f2c937595632e9531b4032e29f50e 7.1/en/os/i386/perl-CGI-2.752-36.1.71.i386.rpm
dfc42b708073a61c3d9f9f9b5c1f7959 7.1/en/os/i386/perl-CPAN-1.59_54-36.1.71.i386.rpm
60c0cabb19f411bcd427b7c683b44536 7.1/en/os/i386/perl-DB_File-1.75-36.1.71.i386.rpm
6c3bd193de0b1c8d19ca93838e089078 7.1/en/os/i386/perl-NDBM_File-1.75-36.1.71.i386.rpm
ab6f508cd17923a23f64fa73c58d523f 7.1/en/os/i386/perl-suidperl-5.6.1-36.1.71.i386.rpm
00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/iSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/iSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm
2fb2e0a065a0239f7bd768dd025c4f67 7.1/en/os/iSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm
b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/iSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm
9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/iSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
3149414b45944023821923206640bbda 7.1/en/os/iSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/iSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
98aad53e528f30a469718504f82e820e 7.1/en/os/iSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
0465a61f126fc211977f14f04b36b798 7.1/en/os/iSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
00b24dc4a3ffcddbfcd4e30232b0b19a 7.1/en/os/pSeries/SRPMS/mod_perl-1.24_01-2.71.2.src.rpm
0994d9f0d307114b9ff5a3a84c78229b 7.1/en/os/pSeries/SRPMS/perl-5.6.1-36.1.71.src.rpm
2fb2e0a065a0239f7bd768dd025c4f67 7.1/en/os/pSeries/ppc/mod_perl-1.24_01-2.71.2.ppc.rpm
b34bc21fdcc6c92a960f3857ad199430 7.1/en/os/pSeries/ppc/perl-5.6.1-36.1.71.ppc.rpm
9d926272a2f9def6a6ed9020ab0d09b3 7.1/en/os/pSeries/ppc/perl-CGI-2.752-36.1.71.ppc.rpm
3149414b45944023821923206640bbda 7.1/en/os/pSeries/ppc/perl-CPAN-1.59_54-36.1.71.ppc.rpm
697f05dfbdcff8e606fc372aaac2b9ee 7.1/en/os/pSeries/ppc/perl-DB_File-1.75-36.1.71.ppc.rpm
98aad53e528f30a469718504f82e820e 7.1/en/os/pSeries/ppc/perl-NDBM_File-1.75-36.1.71.ppc.rpm
0465a61f126fc211977f14f04b36b798 7.1/en/os/pSeries/ppc/perl-suidperl-5.6.1-36.1.71.ppc.rpm
e535d85774a13510bef89bd78b6b216f 7.2/en/os/SRPMS/perl-5.6.1-36.1.72.src.rpm
03ab6415d69d4a102fe234f4b9f22748 7.2/en/os/i386/perl-5.6.1-36.1.72.i386.rpm
d585c9e8a58b09b3e5d4f87f1000db36 7.2/en/os/i386/perl-CGI-2.752-36.1.72.i386.rpm
533d11a6fbc56f584aa5cd45a7dde8dd 7.2/en/os/i386/perl-CPAN-1.59_54-36.1.72.i386.rpm
ea118d193a1d788bc76917aaed12f111 7.2/en/os/i386/perl-DB_File-1.75-36.1.72.i386.rpm
bd85a685357c7c9e06334120bd525915 7.2/en/os/i386/perl-NDBM_File-1.75-36.1.72.i386.rpm
1cd65737a2adb8aff508f4d17d3608c8 7.2/en/os/i386/perl-suidperl-5.6.1-36.1.72.i386.rpm
01e342dd72f0d8aeacd1facfac2534a2 7.2/en/os/ia64/perl-5.6.1-36.1.72.ia64.rpm
b91893cb70d3fd4e3283891194747cf0 7.2/en/os/ia64/perl-CGI-2.752-36.1.72.ia64.rpm
b5d9998614b01d5238db888b4fddcc9b 7.2/en/os/ia64/perl-CPAN-1.59_54-36.1.72.ia64.rpm
6c91069b1f3128a05a4e7a0250227028 7.2/en/os/ia64/perl-DB_File-1.75-36.1.72.ia64.rpm
2f393ca8ddcd822e863d93ab5e4a1bb2 7.2/en/os/ia64/perl-NDBM_File-1.75-36.1.72.ia64.rpm
72af18dbe6f4667f7a726517b15c1f1a 7.2/en/os/ia64/perl-suidperl-5.6.1-36.1.72.ia64.rpm
7b137d76ed95cbf9eecc9d660417b7ed 7.3/en/os/SRPMS/perl-5.6.1-36.1.73.src.rpm
9a4fa98a57ff3b322ba18d9f0bb1864f 7.3/en/os/i386/perl-5.6.1-36.1.73.i386.rpm
9878354d09a308efcbfe00fd6e7665d6 7.3/en/os/i386/perl-CGI-2.752-36.1.73.i386.rpm
ef7af3445fc8c7071febd7fd27a61b45 7.3/en/os/i386/perl-CPAN-1.59_54-36.1.73.i386.rpm
79f963a7050fa706fe684b5e33923fa9 7.3/en/os/i386/perl-DB_File-1.75-36.1.73.i386.rpm
30119242d86c4980cb60d03a0520c5e0 7.3/en/os/i386/perl-NDBM_File-1.75-36.1.73.i386.rpm
d169d03e8992fb0b016685522aa20dc9 7.3/en/os/i386/perl-suidperl-5.6.1-36.1.73.i386.rpm
e27cfe1c0bc442ce7ebd12928479134e 8.0/en/os/SRPMS/perl-5.8.0-88.3.src.rpm
0ac800e33acab6522169d72dac29721b 8.0/en/os/i386/perl-5.8.0-88.3.i386.rpm
cc53faea268b17b68d1494e9cd4d442b 8.0/en/os/i386/perl-CGI-2.81-88.3.i386.rpm
fb2a95814dbefd3a0d5f776f6bc47a27 8.0/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm
abc1c47518fda72936a247d93a175fe4 8.0/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm
69bc3cf938b5b0e6ad2657ceda85d19b 8.0/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm
e27cfe1c0bc442ce7ebd12928479134e 9/en/os/SRPMS/perl-5.8.0-88.3.src.rpm
0ac800e33acab6522169d72dac29721b 9/en/os/i386/perl-5.8.0-88.3.i386.rpm
cc53faea268b17b68d1494e9cd4d442b 9/en/os/i386/perl-CGI-2.81-88.3.i386.rpm
fb2a95814dbefd3a0d5f776f6bc47a27 9/en/os/i386/perl-CPAN-1.61-88.3.i386.rpm
abc1c47518fda72936a247d93a175fe4 9/en/os/i386/perl-DB_File-1.804-88.3.i386.rpm
69bc3cf938b5b0e6ad2657ceda85d19b 9/en/os/i386/perl-suidperl-5.8.0-88.3.i386.rpm


These packages are GPG signed by Red Hat for security.  Our key is
available from https://www.redhat.com/security/keys.html

You can verify each package with the following command:
    
    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    
    md5sum <filename>


8. References:

http://marc.theaimsgroup.com/?l=bugtraq&m=105880349328877
http://bugs6.perl.org/rt2/Ticket/Display.html?id=17744
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1323
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0615

9. Contact:

The Red Hat security contact is <secalert@...hat.com>.  More contact
details at https://www.redhat.com/solutions/security/news/contact.html

Copyright 2003 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/fYiTXlSAg2UNWIIRAr3jAKC3Rt7Rq1MFYgqCfeocSZlyLJO0xwCfdMQj
Cdd1OhMfYDZVMygsDsGN0W0=
=RuwD
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Powered by blists - more mailing lists