Bug 742236 (CVE-2011-2728) - CVE-2011-2728 perl: File::Glob bsd_glob() crash with certain glob flags
Summary: CVE-2011-2728 perl: File::Glob bsd_glob() crash with certain glob flags
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2011-2728
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 742246
TreeView+ depends on / blocked
 
Reported: 2011-09-29 13:30 UTC by Jan Lieskovsky
Modified: 2020-02-11 00:12 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-10-03 05:29:51 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2011-09-29 13:30:40 UTC
An uninitialized pointer dereference flaw was found in the way bsd_glob() (FreeBSD glob(3) routine implementation) File::Glob Perl module implementation processed certain flags (GLOB_ALTDIRFUNC). A remote attacker, able to specify certain 'flags' argument to the Perl application, using the bsd_glob() routine, could use this flaw to cause denial of service of that application (perl executable crash).

References:
[1] http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod
[2] https://secunia.com/advisories/46172/
[3] https://bugs.gentoo.org/show_bug.cgi?id=384887

Comment 1 Jan Lieskovsky 2011-09-29 13:32:13 UTC
This issue affects the versions of the perl package, as shipped with Red Hat Enterprise Linux 4, 5, and 6.

--

This issue affects the versions of the perl package, as shipped with Fedora release of 14 and 15.

Comment 4 Tomas Hoger 2011-09-29 14:07:52 UTC
Sounds like a perl variant of the php bug #718253.  Not sure why it's called security rather than a bug, can't think of a good reason to allow taking glob flags parameter from an untrusted input.

Comment 6 Huzaifa S. Sidhpurwala 2011-10-03 05:29:51 UTC
Upstream patch which fixed this issue:
http://perl5.git.perl.org/perl.git/commit/1af4051e077438976a4c12a0622feaf6715bec77

The crash is caused by the use of uninitialized function pointer. 

The Script author would control the flag parameter passed to the glob function and it is unlikely that an untrusted input would directly be passed as flags to bsd_glob().

Statement:

Red Hat does not consider this flaw to be a security issue. The flags argument passed to the bsd_glob() function is solely under the control of the script author.


Note You need to log in before you can comment on or make changes to this bug.