Bug 742236 (CVE-2011-2728)

Summary:	CVE-2011-2728 perl: File::Glob bsd_glob() crash with certain glob flags
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	cweyl, iarnell, kasal, lkundrak, mmaslano, perl-maint-list, ppisar, psabata, rc040203, tcallawa
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-10-03 05:29:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	742246

Description Jan Lieskovsky 2011-09-29 13:30:40 UTC

An uninitialized pointer dereference flaw was found in the way bsd_glob() (FreeBSD glob(3) routine implementation) File::Glob Perl module implementation processed certain flags (GLOB_ALTDIRFUNC). A remote attacker, able to specify certain 'flags' argument to the Perl application, using the bsd_glob() routine, could use this flaw to cause denial of service of that application (perl executable crash).

References:
[1] http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod
[2] https://secunia.com/advisories/46172/
[3] https://bugs.gentoo.org/show_bug.cgi?id=384887

Comment 1 Jan Lieskovsky 2011-09-29 13:32:13 UTC

This issue affects the versions of the perl package, as shipped with Red Hat Enterprise Linux 4, 5, and 6.

--

This issue affects the versions of the perl package, as shipped with Fedora release of 14 and 15.

Comment 4 Tomas Hoger 2011-09-29 14:07:52 UTC

Sounds like a perl variant of the php bug #718253.  Not sure why it's called security rather than a bug, can't think of a good reason to allow taking glob flags parameter from an untrusted input.

Comment 6 Huzaifa S. Sidhpurwala 2011-10-03 05:29:51 UTC

Upstream patch which fixed this issue:
http://perl5.git.perl.org/perl.git/commit/1af4051e077438976a4c12a0622feaf6715bec77

The crash is caused by the use of uninitialized function pointer. 

The Script author would control the flag parameter passed to the glob function and it is unlikely that an untrusted input would directly be passed as flags to bsd_glob().

Statement:

Red Hat does not consider this flaw to be a security issue. The flags argument passed to the bsd_glob() function is solely under the control of the script author.