PT-2004-1578 · Perl+1 · Perl+1

Paul Szabo · Published 2004-12-21 · Updated 2017-10-11 · CVE-2004-0452

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:L/AC:H/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Perl versions 5.6.1 through 5.8.4

Description The issue is related to a race condition in the rmtree function within the File::Path module. This condition allows local users to potentially delete arbitrary files and directories, and possibly read files and directories, by exploiting a symlink attack.

Recommendations For versions 5.6.1 through 5.8.4, consider applying configuration changes to restrict file and directory access until a patch is available. As a temporary workaround, restrict the use of the rmtree function in the File::Path module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0452

DSA-1678-1

DSA-620-1

RHSA-2005:103

RHSA-2005:105

RHSA-2005_103

RHSA-2005_105

Affected Products

Perl

Red Hat

References · 25

• http://debian.org/security/2004/dsa-620 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200501-38.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0452 · Vendor Advisory
• http://fedoranews.org/updates/FEDORA--.shtml · Vendor Advisory
• https://ubuntu.com/usn/usn-44-1 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-103.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0452 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-105.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0452 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18650 · Note
• https://redhat.com/security/data/cve/CVE-2004-0452.html · Note
• http://gentoo.org/security/en/glsa/glsa-200502-13.xml · Note
• http://marc.info/?l=bugtraq&m=110547693019788&w=2 · Note