CVE-2005-0156

Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056
http://fedoranews.org/updates/FEDORA--.shtml
http://marc.info/?l=bugtraq&m=110737149402683&w=2
http://marc.info/?l=full-disclosure&m=110779721503111&w=2
http://secunia.com/advisories/14120
http://secunia.com/advisories/55314
http://www.digitalmunition.com/DMA%5B2005-0131b%5D.txt
http://www.gentoo.org/security/en/glsa/glsa-200502-13.xml	Exploit Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:031
http://www.redhat.com/support/errata/RHSA-2005-103.html	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-105.html	Patch Vendor Advisory
http://www.securityfocus.com/bid/12426	Patch Vendor Advisory
http://www.trustix.org/errata/2005/0003/	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19208
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10803
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056
http://fedoranews.org/updates/FEDORA--.shtml
http://marc.info/?l=bugtraq&m=110737149402683&w=2
http://marc.info/?l=full-disclosure&m=110779721503111&w=2
http://secunia.com/advisories/14120
http://secunia.com/advisories/55314
http://www.digitalmunition.com/DMA%5B2005-0131b%5D.txt
http://www.gentoo.org/security/en/glsa/glsa-200502-13.xml	Exploit Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:031
http://www.redhat.com/support/errata/RHSA-2005-103.html	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-105.html	Patch Vendor Advisory
http://www.securityfocus.com/bid/12426	Patch Vendor Advisory
http://www.trustix.org/errata/2005/0003/	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/19208
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10803

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:larry_wall:perl:5.8.0:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.1:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.3:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.4:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.4.1:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.4.2:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.4.2.3:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.4.3:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.4.4:::::::*
	cpe:2.3:a:larry_wall:perl:5.8.4.5:::::::*
	cpe:2.3:a:sgi:propack:3.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:ibm:aix:5.2:::::::*
	cpe:2.3:o:ibm:aix:5.3:::::::*
	cpe:2.3:o:redhat:enterprise_linux:3.0::advanced_server:::::
	cpe:2.3:o:redhat:enterprise_linux:3.0::enterprise_server:::::
	cpe:2.3:o:redhat:enterprise_linux:3.0::workstation_server:::::
	cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:::::::*
	cpe:2.3:o:redhat:fedora_core:core_3.0:::::::*
	cpe:2.3:o:suse:suse_linux:8.0:::::::*
	cpe:2.3:o:suse:suse_linux:8.0::i386:::::
	cpe:2.3:o:suse:suse_linux:8.1:::::::*
	cpe:2.3:o:suse:suse_linux:8.2:::::::*
	cpe:2.3:o:suse:suse_linux:9.0:::::::*
	cpe:2.3:o:suse:suse_linux:9.0::x86_64:::::
	cpe:2.3:o:suse:suse_linux:9.1:::::::*
	cpe:2.3:o:suse:suse_linux:9.2:::::::*
	cpe:2.3:o:trustix:secure_linux:1.5:::::::*
	cpe:2.3:o:trustix:secure_linux:2.0:::::::*
	cpe:2.3:o:trustix:secure_linux:2.1:::::::*
	cpe:2.3:o:trustix:secure_linux:2.2:::::::*
	cpe:2.3:o:ubuntu:ubuntu_linux:4.1::ia64:::::
	cpe:2.3:o:ubuntu:ubuntu_linux:4.1::ppc:::::

History

20 Nov 2024, 23:54

Information

Published : 2005-02-07 05:00

Updated : 2025-04-03 01:03

NVD link : CVE-2005-0156

Mitre link : CVE-2005-0156

CVE.ORG link : CVE-2005-0156

JSON object : View

Products Affected

redhat

fedora_core
enterprise_linux
enterprise_linux_desktop

trustix

secure_linux

ubuntu

ubuntu_linux

larry_wall

perl

suse

suse_linux

ibm

sgi

propack

CWE

NVD-CWE-Other

{"id": "CVE-2005-0156", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-02-07T05:00:00.000", "references": [{"url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056", "source": "cve@mitre.org"}, {"url": "http://fedoranews.org/updates/FEDORA--.shtml", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=110737149402683&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=full-disclosure&m=110779721503111&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/14120", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/55314", "source": "cve@mitre.org"}, {"url": "http://www.digitalmunition.com/DMA%5B2005-0131b%5D.txt", "source": "cve@mitre.org"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200502-13.xml", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:031", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2005-103.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2005-105.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/12426", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.trustix.org/errata/2005/0003/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19208", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10803", "source": "cve@mitre.org"}, {"url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://fedoranews.org/updates/FEDORA--.shtml", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://marc.info/?l=bugtraq&m=110737149402683&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://marc.info/?l=full-disclosure&m=110779721503111&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/14120", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/55314", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.digitalmunition.com/DMA%5B2005-0131b%5D.txt", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200502-13.xml", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:031", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.redhat.com/support/errata/RHSA-2005-103.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.redhat.com/support/errata/RHSA-2005-105.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/12426", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.trustix.org/errata/2005/0003/", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19208", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10803", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:larry_wall:perl:5.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3D30E072-9E6A-49B4-A5C7-63A328598A68"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "434F0580-985F-42AF-BA10-FAB7E2C23ED0"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18B179E0-C843-46C9-AAD2-78E998175E41"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD5E5A51-ED4C-4927-8C4D-502E79391E19"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "171C82CB-2E92-4D41-B1B1-DCFE929E8270"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25633253-D9DE-41F0-A787-D0E8B2B3B9F0"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.4.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEDF9611-E4E2-4059-B45E-D3A61AC9DB47"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49A9D197-D889-4BE4-BE7A-2EE9536A7498"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0A4538C-3870-431E-A225-D8523D77A4E4"}, {"criteria": "cpe:2.3:a:larry_wall:perl:5.8.4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8233B3A-E09D-425B-B1A1-65CD170FD384"}, {"criteria": "cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29DC217F-C257-4A3C-9CBD-08010C30BEC3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:aix:5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17EECCCB-D7D1-439A-9985-8FAE8B44487B"}, {"criteria": "cpe:2.3:o:ibm:aix:5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA8DDF4A-1C5D-4CB1-95B3-69EAE6572507"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:3.0:*:advanced_server:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78B46FFA-5B09-473E-AD33-3DB18BD0DAFE"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:3.0:*:enterprise_server:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC79FF22-2664-4C40-B0B3-6D23B5F45162"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:3.0:*:workstation_server:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EFE2E73-9536-41A9-B83B-0A06B54857F4"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF3BBBC3-3EF9-4E24-9DE2-627E172A5473"}, {"criteria": "cpe:2.3:o:redhat:fedora_core:core_3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC80CF67-C51D-442C-9526-CFEDE84A6304"}, {"criteria": "cpe:2.3:o:suse:suse_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28CD54FE-D682-4063-B7C3-8B29B26B39AD"}, {"criteria": "cpe:2.3:o:suse:suse_linux:8.0:*:i386:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37F124FE-15F1-49D7-9E03-8E036CE1A20C"}, {"criteria": "cpe:2.3:o:suse:suse_linux:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8C55338-3372-413F-82E3-E1B476D6F41A"}, {"criteria": "cpe:2.3:o:suse:suse_linux:8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EFB33BF-F6A5-48C1-AEB5-194FCBCFC958"}, {"criteria": "cpe:2.3:o:suse:suse_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB0E2D3B-B50A-46C2-BA1E-3E014DE91954"}, {"criteria": "cpe:2.3:o:suse:suse_linux:9.0:*:x86_64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56EF103F-5668-4754-A83B-D3662D0CE815"}, {"criteria": "cpe:2.3:o:suse:suse_linux:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFABFCE5-4F86-4AE8-9849-BC360AC72098"}, {"criteria": "cpe:2.3:o:suse:suse_linux:9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFF36BC6-6CCD-4FEE-A120-5B8C4BF5620C"}, {"criteria": "cpe:2.3:o:trustix:secure_linux:1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39605B96-BAD6-45C9-BB9A-43D6E2C51ADD"}, {"criteria": "cpe:2.3:o:trustix:secure_linux:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53AF1A2D-B0A2-4097-AD1D-DF3AF27171BA"}, {"criteria": "cpe:2.3:o:trustix:secure_linux:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A67735E5-E43E-4164-BDB2-ADC6E0288E9F"}, {"criteria": "cpe:2.3:o:trustix:secure_linux:2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5AB70F82-52BB-4D0D-9A24-9AF67278466D"}, {"criteria": "cpe:2.3:o:ubuntu:ubuntu_linux:4.1:*:ia64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E94583A-5184-462E-9FC4-57B35DA06DA7"}, {"criteria": "cpe:2.3:o:ubuntu:ubuntu_linux:4.1:*:ppc:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E905FAAD-37B6-4DD0-A752-2974F8336273"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

2.1 /10