Executive Summary

Summary
Title Perl Module-Signature module: Arbitrary code execution
Informations
Name GLSA-201310-01 First vendor Publication 2013-10-04
Vendor Gentoo Last vendor Modification 2013-10-04
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 4.4 Attack Range Local
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 3.4 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

The Module-Signature module for Perl has insufficient path checks, allowing a remote attacker to execute arbitrary Perl code.

Background

The Perl Module::Signature module adds signing capabilities to CPAN modules.

Description

The 'cpansign verify' command will automatically download keys and use them to check the signature of CPAN packages via the SIGNATURE file. If an attacker were to replace this (SHA1) with a special unknown cipher
(e.g. 'Special') and were to include in the distribution a
'Digest/Special.pm', the code in this Perl module would be executed when 'cpansign -verify' is run.

Impact

A remote attacker could possibly execute arbitrary code with the privileges of the process.

Workaround

There is no known workaround at this time.

Resolution

All users of the Module-Signature Perl module should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=dev-perl/Module-Signature-0.720.0"

References

[ 1 ] CVE-2013-2145 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2145

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201310-01.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201310-01.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18074
 
Oval ID: oval:org.mitre.oval:def:18074
Title: USN-1896-1 -- libmodule-signature-perl vulnerability
Description: Module::Signature could be made to run programs if it verified a signatur e.
Family: unix Class: patch
Reference(s): USN-1896-1
CVE-2013-2145
 Version: 7
Platform(s): Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04
 Product(s): libmodule-signature-perl
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2
Os 3
Os 3

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-573.nasl - Type : ACT_GATHER_INFO
2013-10-06 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201310-01.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Fedora host is missing a security update.
File : fedora_2013-10354.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Fedora host is missing a security update.
File : fedora_2013-10415.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Fedora host is missing a security update.
File : fedora_2013-10430.nasl - Type : ACT_GATHER_INFO
2013-07-05 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1896-1.nasl - Type : ACT_GATHER_INFO
2013-06-28 Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2013-185.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 11:37:47
  • Multiple Updates
2013-10-04 09:23:03
  • First insertion