National Cyber Awareness System

Vulnerability Summary for CVE-2012-2451

Overview

The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. NOTE: some of these details are obtained from third party information. NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59

Type: Patch Information; Exploit

Hyperlink:https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=818386

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=818386

External Source: XF

Name: config-inifiles-symlink(75328)

Hyperlink:http://xforce.iss.net/xforce/xfdb/75328

External Source: UBUNTU

Name: USN-1543-1

Hyperlink:http://www.ubuntu.com/usn/USN-1543-1

External Source: BID

Name: 53361

Hyperlink:http://www.securityfocus.com/bid/53361

External Source: OSVDB

Name: 81671

Hyperlink:http://www.osvdb.org/81671

External Source: MLIST

Name: [oss-security] 20120502 temporary file issue in Config::IniFiles Config-IniFiles perl-Config-IniFiles

Hyperlink:http://www.openwall.com/lists/oss-security/2012/05/02/6

External Source: SECUNIA

Name: 48990

Type: Advisory

Hyperlink:http://secunia.com/advisories/48990

External Source: FEDORA

Name: FEDORA-2012-7763

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html

External Source: FEDORA

Name: FEDORA-2012-7777

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html

External Source: FEDORA

Name: FEDORA-2012-7802

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html