Bug 473450 (CVE-2008-5302)

Summary: CVE-2008-5302 perl: File::Path rmtree race condition (CVE-2005-0448) reintroduced after upstream rebase to 5.8.8-1
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bressers, mmaslano, psplicha, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-06-08 06:22:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 591167, 591168    
Bug Blocks:    
Attachments:
Description Flags
Ours perl-5.8.0-CAN-2005-0448-rmtree.patch applied against perl_5.8.0-90.4 none

Description Jan Lieskovsky 2008-11-28 15:55:06 UTC 
Created attachment 325021 [details]
Ours perl-5.8.0-CAN-2005-0448-rmtree.patch applied against perl_5.8.0-90.4

Common Vulnerabilities and Exposures originally assigned an identifier CVE-2005-0448 to the following vulnerability:

Race condition in the rmtree function in File::Path.pm in Perl before 5.8.4 allows local users to create arbitrary setuid binaries in the tree being
deleted, a different vulnerability than CVE-2004-0452.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0448

It was discovered that after upstream perl rebase to 5.8.8-1, this issue
was reintroduced (seems upstream didn't apply fix for CVE-2005-0448).

This issue already fixed again in perl-5.10.

References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905

Link to original CVE-2005-0448 patch:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=85;filename=etch_03_fix_file_path;att=1;bug=286905

Patch we applied in RHSA-2005:881(el3) and in RHSA-2005:674(el4):
see attachment


Note: This is different vulnerability then CVE-2004-0452, CVE-2005-0448
and yet different to CVE-2008-2827.
Comment 1 Vincent Danen 2009-03-25 17:37:07 UTC 
The Red Hat Security Response Team has rated this issue as having low security
impact, a future update may address this flaw.  More information regarding
issue severity can be found here:
http://www.redhat.com/security/updates/classification/
Comment 11 errata-xmlrpc 2010-06-07 16:21:41 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0458 https://rhn.redhat.com/errata/RHSA-2010-0458.html