2.6
CVSSv2

CVE-2004-0452

Published: 21/12/2004 Updated: 11/10/2017
CVSS v2 Base Score: 2.6 | Impact Score: 4.9 | Exploitability Score: 1.9
VMScore: 231
Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P

Vulnerability Summary

Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack.

Vulnerable Product Search on Vulmon Subscribe to Product

larry wall perl 5.6.1

larry wall perl 5.8.4

Vendor Advisories

Debian Bug report logs - #487319 perl-modules: File::Path::rmtree sets symlink target permissions to 0777 Package: perl-modules; Maintainer for perl-modules is Niko Tyni <ntyni@debianorg>; Source for perl-modules is src:perl (PTS, buildd, popcon) Reported by: Ben Hutchings <ben@decadentorguk> Date: Fri, 20 Jun 200 ...
A race condition and possible information leak has been discovered in Perl’s File::Path::rmtree() This function changes the permission of files and directories before removing them to avoid problems with wrong permissions However, they were made readable and writable not only for the owner, but for the entire world, which opened a race conditio ...
Synopsis perl security update Type/Severity Security Advisory: Important Topic Updated Perl packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4This update has been rated as having important security impact by the RedHat Security Response Team Description ...
Synopsis perl security update Type/Severity Security Advisory: Important Topic Updated Perl packages that fix several security issues are now availablefor Red Hat Enterprise Linux 3 Description Perl is a high-level programming language commonly used for systemadministration utilities and W ...