PT-1999-1699 · Perl · Perl

Published

1999-12-31

·

Updated

2024-01-26

·

CVE-1999-1386

CVSS v2.0

2.1

Low

VectorAV:L/AC:L/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions: Perl versions 5.004 04 and earlier
Description: The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file when Perl is run with the -e option. This is due to Perl following symbolic links.
Recommendations: For versions 5.004 04 and earlier, consider restricting the use of the -e option until a patch is available to prevent symlink attacks. As a temporary workaround, avoid using the -e option with untrusted input to minimize the risk of exploitation.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-1999-1386

Affected Products

Perl