Red Hat Bugzilla – Bug 884354
CVE-2012-6329 perl: possible arbitrary code execution via Locale::Maketext
Last modified: 2013-11-05 06:49:58 EST
A commit to the upstream perl git repository  indicated that perl's Locale::Maketext was vulnerable to a flaw that could lead to arbitrary code execution of this function was executed on user-supplied input. Quoting the commit message:
Case 61251: This commit fixes a misparse of maketext strings that could
lead to arbitrary code execution. Basically, maketext was compiling
bracket notation into functions, but neglected to escape backslashes
inside the content or die on fully-qualified method names when
generating the code. This change escapes all such backslashes and dies
when a method name with a colon or apostrophe is specified.
In perl 5.8.8 and 5.10.1, this affected code is in lib/Locale/Maketext/Guts.pm, not lib/Locale/Maketext.pm (as implied in the git commit above).
Created perl tracking bugs for this issue
Affects: fedora-all [bug 884363]
Created attachment 658787 [details]
Template for reproducer
Could show the attack vector? Attached is small code showing how to use Locale::Maketext. Please modify it to explain the vulnerability.
I think the vulnerability is effective only when attacker has first argument of maketext() under control.
However that means the attacker can run any code even without this `vulnerability'. It's like saying glibc's gettext() is vulnerable. But that's not true.
Sure gettext("%s", user_input) is not safe, but this is flaw in the caller, not in the gettext. The same applies to Locale::Maketext::maketext().
And actually the patch breaks behaviour because it forbids cross-package calls which were explicitly allowed and documented before. I disbelieve the patch is good candidate for stable distributions.
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-6329 to
the following vulnerability:
The _compile function in Maketext.pm in the Locale::Maketext
implementation in Perl before 5.17.7 does not properly handle
backslashes and fully qualified method names during compilation of
bracket notation, which allows context-dependent attackers to execute
arbitrary commands via crafted input to an application that accepts
translation strings from users, as demonstrated by the TWiki
application before 5.1.3, and the Foswiki application 1.0.x through
1.0.10 and 1.1.x through 1.1.6.
Created attachment 676781 [details]
perl-5.14.3-205.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
perl-5.16.2-237.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
perl-5.14.3-221.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
Created attachment 704920 [details]
Fix ported to perl-5.10.1
Created attachment 705056 [details]
Fix ported to perl-5.8.8
Created attachment 705349 [details]
Fix ported to perl-5.8.8
Corrected fix (previous version had unbalanced curly bracket).
Created attachment 705351 [details]
This code based on the Template attachment demonstrates calling function from other module (POSIX::printf() in this case).
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Via RHSA-2013:0685 https://rhn.redhat.com/errata/RHSA-2013-0685.html