Bug 884354 - (CVE-2012-6329) CVE-2012-6329 perl: possible arbitrary code execution via Locale::Maketext
CVE-2012-6329 perl: possible arbitrary code execution via Locale::Maketext
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
http://thread.gmane.org/gmane.comp.la...
impact=moderate,public=20121204,repor...
: Security
Depends On: 884363 915690 915691 915692 915693
Blocks: 884356
  Show dependency treegraph
 
Reported: 2012-12-05 22:28 EST by Vincent Danen
Modified: 2013-11-05 06:49 EST (History)
17 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-03-26 15:58:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Template for reproducer (433 bytes, text/plain)
2012-12-06 10:08 EST, Petr Pisar
no flags Details
Upstream fix (3.37 KB, patch)
2013-01-11 05:34 EST, Petr Pisar
no flags Details | Diff
Fix ported to perl-5.10.1 (3.29 KB, patch)
2013-03-04 07:01 EST, Petr Pisar
no flags Details | Diff
Fix ported to perl-5.8.8 (3.05 KB, patch)
2013-03-04 10:58 EST, Petr Pisar
no flags Details | Diff
Fix ported to perl-5.8.8 (3.06 KB, patch)
2013-03-05 05:09 EST, Petr Pisar
no flags Details | Diff
Partial reproducer (495 bytes, text/plain)
2013-03-05 05:12 EST, Petr Pisar
no flags Details

  None (edit)
Description Vincent Danen 2012-12-05 22:28:11 EST
A commit to the upstream perl git repository [1] indicated that perl's Locale::Maketext was vulnerable to a flaw that could lead to arbitrary code execution of this function was executed on user-supplied input.  Quoting the commit message:

Case 61251: This commit fixes a misparse of maketext strings that could
lead to arbitrary code execution.  Basically, maketext was compiling
bracket notation into functions, but neglected to escape backslashes
inside the content or die on fully-qualified method names when
generating the code.  This change escapes all such backslashes and dies
when a method name with a colon or apostrophe is specified.

[1] http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
Comment 1 Vincent Danen 2012-12-05 23:05:18 EST
In perl 5.8.8 and 5.10.1, this affected code is in lib/Locale/Maketext/Guts.pm, not lib/Locale/Maketext.pm (as implied in the git commit above).
Comment 2 Vincent Danen 2012-12-05 23:06:30 EST
Created perl tracking bugs for this issue

Affects: fedora-all [bug 884363]
Comment 3 Petr Pisar 2012-12-06 10:08:20 EST
Created attachment 658787 [details]
Template for reproducer

Could show the attack vector? Attached is small code showing how to use Locale::Maketext. Please modify it to explain the vulnerability.

I think the vulnerability is effective only when attacker has first argument of maketext() under control.

However that means the attacker can run any code even without this `vulnerability'. It's like saying glibc's gettext() is vulnerable. But that's not true.

Sure gettext("%s", user_input) is not safe, but this is flaw in the caller, not in the gettext. The same applies to Locale::Maketext::maketext().
Comment 4 Petr Pisar 2012-12-06 11:18:46 EST
And actually the patch breaks behaviour because it forbids cross-package calls which were explicitly allowed and documented before. I disbelieve the patch is good candidate for stable distributions.
Comment 6 Vincent Danen 2013-01-04 16:59:53 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-6329 to
the following vulnerability:

Name: CVE-2012-6329
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6329
Assigned: 20121210
Reference: http://sourceforge.net/mailarchive/message.php?msg_id=30219695
Reference: http://openwall.com/lists/oss-security/2012/12/11/4
Reference: http://code.activestate.com/lists/perl5-porters/187763/
Reference: http://code.activestate.com/lists/perl5-porters/187746/
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=884354
Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695224
Reference: http://perl5.git.perl.org/perl.git/blob/HEAD:/pod/perl5177delta.pod
Reference: http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
Reference: http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329

The _compile function in Maketext.pm in the Locale::Maketext
implementation in Perl before 5.17.7 does not properly handle
backslashes and fully qualified method names during compilation of
bracket notation, which allows context-dependent attackers to execute
arbitrary commands via crafted input to an application that accepts
translation strings from users, as demonstrated by the TWiki
application before 5.1.3, and the Foswiki application 1.0.x through
1.0.10 and 1.1.x through 1.1.6.
Comment 7 Petr Pisar 2013-01-11 05:34:09 EST
Created attachment 676781 [details]
Upstream fix
Comment 8 Fedora Update System 2013-01-24 16:54:45 EST
perl-5.14.3-205.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-01-29 19:53:51 EST
perl-5.16.2-237.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2013-02-18 20:37:48 EST
perl-5.14.3-221.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Petr Pisar 2013-03-04 07:01:24 EST
Created attachment 704920 [details]
Fix ported to perl-5.10.1
Comment 13 Petr Pisar 2013-03-04 10:58:52 EST
Created attachment 705056 [details]
Fix ported to perl-5.8.8
Comment 14 Petr Pisar 2013-03-05 05:09:22 EST
Created attachment 705349 [details]
Fix ported to perl-5.8.8

Corrected fix (previous version had unbalanced curly bracket).
Comment 15 Petr Pisar 2013-03-05 05:12:56 EST
Created attachment 705351 [details]
Partial reproducer

This code based on the Template attachment demonstrates calling function from other module (POSIX::printf() in this case).
Comment 16 errata-xmlrpc 2013-03-26 15:27:44 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2013:0685 https://rhn.redhat.com/errata/RHSA-2013-0685.html

Note You need to log in before you can comment on or make changes to this bug.