Bug 884354 (CVE-2012-6329)

Summary: CVE-2012-6329 perl: possible arbitrary code execution via Locale::Maketext
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bleanhar, cweyl, iarnell, jialiu, jplesnik, kasal, lkundrak, lmeyer, mmaslano, perl-devel, perl-maint-list, ppisar, psabata, rc040203, rmillner, tcallawa, tkramer
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://thread.gmane.org/gmane.comp.lang.perl.perl5.porters/118434
See Also: https://bugzilla.redhat.com/show_bug.cgi?id=1025906
https://bugzilla.redhat.com/show_bug.cgi?id=1026761
https://bugzilla.redhat.com/show_bug.cgi?id=1026763
Whiteboard: impact=moderate,public=20121204,reported=20121205,source=debian,cvss2=5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P,rhel-5/perl=affected,rhel-6/perl=affected,fedora-all/perl=affected,openshift-1/cartridge-perl=affected,openshift-enterprise-1/perl=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-26 15:58:00 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 884363, 915690, 915691, 915692, 915693    
Bug Blocks: 884356    
Attachments:
Description Flags
Template for reproducer
none
Upstream fix
none
Fix ported to perl-5.10.1
none
Fix ported to perl-5.8.8
none
Fix ported to perl-5.8.8
none
Partial reproducer none

Description Vincent Danen 2012-12-05 22:28:11 EST
A commit to the upstream perl git repository [1] indicated that perl's Locale::Maketext was vulnerable to a flaw that could lead to arbitrary code execution of this function was executed on user-supplied input.  Quoting the commit message:

Case 61251: This commit fixes a misparse of maketext strings that could
lead to arbitrary code execution.  Basically, maketext was compiling
bracket notation into functions, but neglected to escape backslashes
inside the content or die on fully-qualified method names when
generating the code.  This change escapes all such backslashes and dies
when a method name with a colon or apostrophe is specified.

[1] http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
Comment 1 Vincent Danen 2012-12-05 23:05:18 EST
In perl 5.8.8 and 5.10.1, this affected code is in lib/Locale/Maketext/Guts.pm, not lib/Locale/Maketext.pm (as implied in the git commit above).
Comment 2 Vincent Danen 2012-12-05 23:06:30 EST
Created perl tracking bugs for this issue

Affects: fedora-all [bug 884363]
Comment 3 Petr Pisar 2012-12-06 10:08:20 EST
Created attachment 658787 [details]
Template for reproducer

Could show the attack vector? Attached is small code showing how to use Locale::Maketext. Please modify it to explain the vulnerability.

I think the vulnerability is effective only when attacker has first argument of maketext() under control.

However that means the attacker can run any code even without this `vulnerability'. It's like saying glibc's gettext() is vulnerable. But that's not true.

Sure gettext("%s", user_input) is not safe, but this is flaw in the caller, not in the gettext. The same applies to Locale::Maketext::maketext().
Comment 4 Petr Pisar 2012-12-06 11:18:46 EST
And actually the patch breaks behaviour because it forbids cross-package calls which were explicitly allowed and documented before. I disbelieve the patch is good candidate for stable distributions.
Comment 6 Vincent Danen 2013-01-04 16:59:53 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-6329 to
the following vulnerability:

Name: CVE-2012-6329
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6329
Assigned: 20121210
Reference: http://sourceforge.net/mailarchive/message.php?msg_id=30219695
Reference: http://openwall.com/lists/oss-security/2012/12/11/4
Reference: http://code.activestate.com/lists/perl5-porters/187763/
Reference: http://code.activestate.com/lists/perl5-porters/187746/
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=884354
Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695224
Reference: http://perl5.git.perl.org/perl.git/blob/HEAD:/pod/perl5177delta.pod
Reference: http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
Reference: http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329

The _compile function in Maketext.pm in the Locale::Maketext
implementation in Perl before 5.17.7 does not properly handle
backslashes and fully qualified method names during compilation of
bracket notation, which allows context-dependent attackers to execute
arbitrary commands via crafted input to an application that accepts
translation strings from users, as demonstrated by the TWiki
application before 5.1.3, and the Foswiki application 1.0.x through
1.0.10 and 1.1.x through 1.1.6.
Comment 7 Petr Pisar 2013-01-11 05:34:09 EST
Created attachment 676781 [details]
Upstream fix
Comment 8 Fedora Update System 2013-01-24 16:54:45 EST
perl-5.14.3-205.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-01-29 19:53:51 EST
perl-5.16.2-237.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2013-02-18 20:37:48 EST
perl-5.14.3-221.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Petr Pisar 2013-03-04 07:01:24 EST
Created attachment 704920 [details]
Fix ported to perl-5.10.1
Comment 13 Petr Pisar 2013-03-04 10:58:52 EST
Created attachment 705056 [details]
Fix ported to perl-5.8.8
Comment 14 Petr Pisar 2013-03-05 05:09:22 EST
Created attachment 705349 [details]
Fix ported to perl-5.8.8

Corrected fix (previous version had unbalanced curly bracket).
Comment 15 Petr Pisar 2013-03-05 05:12:56 EST
Created attachment 705351 [details]
Partial reproducer

This code based on the Template attachment demonstrates calling function from other module (POSIX::printf() in this case).
Comment 16 errata-xmlrpc 2013-03-26 15:27:44 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2013:0685 https://rhn.redhat.com/errata/RHSA-2013-0685.html