Red Hat Bugzilla – Bug 742236
CVE-2011-2728 perl: File::Glob bsd_glob() crash with certain glob flags
Last modified: 2011-10-04 03:51:47 EDT
An uninitialized pointer dereference flaw was found in the way bsd_glob() (FreeBSD glob(3) routine implementation) File::Glob Perl module implementation processed certain flags (GLOB_ALTDIRFUNC). A remote attacker, able to specify certain 'flags' argument to the Perl application, using the bsd_glob() routine, could use this flaw to cause denial of service of that application (perl executable crash). References: [1] http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod [2] https://secunia.com/advisories/46172/ [3] https://bugs.gentoo.org/show_bug.cgi?id=384887
This issue affects the versions of the perl package, as shipped with Red Hat Enterprise Linux 4, 5, and 6. -- This issue affects the versions of the perl package, as shipped with Fedora release of 14 and 15.
Sounds like a perl variant of the php bug #718253. Not sure why it's called security rather than a bug, can't think of a good reason to allow taking glob flags parameter from an untrusted input.
Upstream patch which fixed this issue: http://perl5.git.perl.org/perl.git/commit/1af4051e077438976a4c12a0622feaf6715bec77 The crash is caused by the use of uninitialized function pointer. The Script author would control the flag parameter passed to the glob function and it is unlikely that an untrusted input would directly be passed as flags to bsd_glob(). Statement: Red Hat does not consider this flaw to be a security issue. The flags argument passed to the bsd_glob() function is solely under the control of the script author.