2.6
CVSSv2

CVE-2004-0452

Published: 21/12/2004 Updated: 11/10/2017
CVSS v2 Base Score: 2.6 | Impact Score: 4.9 | Exploitability Score: 1.9
VMScore: 231
Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P

Vulnerability Summary

Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack.

Affected Products

Vendor Product Versions
Larry WallPerl5.6.1, 5.8.4

Vendor Advisories

A race condition and possible information leak has been discovered in Perl’s File::Path::rmtree() This function changes the permission of files and directories before removing them to avoid problems with wrong permissions However, they were made readable and writable not only for the owner, but for the entire world, which opened a race conditio ...
Debian Bug report logs - #487319 perl-modules: File::Path::rmtree sets symlink target permissions to 0777 Package: perl-modules; Maintainer for perl-modules is Niko Tyni <ntyni@debianorg>; Source for perl-modules is src:perl (PTS, buildd, popcon) Reported by: Ben Hutchings <ben@decadentorguk> Date: Fri, 20 Jun 200 ...
Synopsis perl security update Type/Severity Security Advisory: Important Topic Updated Perl packages that fix several security issues are now availablefor Red Hat Enterprise Linux 3 Description Perl is a high-level programming language commonly used for systemadministration utilities and W ...
Synopsis perl security update Type/Severity Security Advisory: Important Topic Updated Perl packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4This update has been rated as having important security impact by the RedHat Security Response Team Description ...