commit e9c31e5fe012574693edcec484ad502c46db34a2
Author: Petr Písař <ppisar@xxxxxxxxxx>
Date: Thu Dec 1 15:46:19 2011 +0100
Fix CVE-2011-4114
perl-PAR-1.002-CVE-2011-4114.patch | 89 ++++++++++++++++++++++++++++++++++++
perl-PAR.spec | 10 ++++-
2 files changed, 98 insertions(+), 1 deletions(-)
---
diff --git a/perl-PAR-1.002-CVE-2011-4114.patch b/perl-PAR-1.002-CVE-2011-4114.patch
new file mode 100644
index 0000000..4db8a94
--- /dev/null
+++ b/perl-PAR-1.002-CVE-2011-4114.patch
@@ -0,0 +1,89 @@
+Fix CVE-2011-4114
+
+From: r1305 | rschupp | 2011-11-28 17:39:44 +0100 (Po, 28 lis 2011) | 7 lines
+RT #69560/CVE-2011-4114: PAR packed files are extracted to unsafe and
+predictable temporary directories
+- create parent of cache directory (i.e. /tmp/par-USER) with mode 0700
+- if it already exists, check that (and bail out if not)
+ - it's not a symlink
+ - it's mode 0700
+ - it's owned by USER
+
+Petr Pisar: Message wording adjustment from r1316 is included too.
+
+Index: lib/PAR/SetupTemp.pm
+===================================================================
+--- lib/PAR/SetupTemp.pm (revision 1304)
++++ lib/PAR/SetupTemp.pm (revision 1305)
+@@ -5,6 +5,8 @@
+ use strict;
+ use warnings;
+
++use Fcntl ':mode';
++
+ use PAR::SetupProgname;
+
+ =head1 NAME
+@@ -42,8 +44,9 @@
+ }
+
+ my $stmpdir = _get_par_user_tempdir();
++ die "unable to create cache directory" unless $stmpdir;
++
+ require File::Spec;
+- if (defined $stmpdir) { # it'd be quite bad if this was not the case
+ if (!$ENV{PAR_CLEAN} and my $mtime = (stat($PAR::SetupProgname::Progname))[9]) {
+ my $ctx = _get_digester();
+
+@@ -71,8 +74,7 @@
+ }
+
+ $ENV{PAR_TEMP} = $stmpdir;
+- mkdir $stmpdir, 0755;
+- } # end if found a temp dir
++ mkdir $stmpdir, 0700;
+
+ $PARTemp = $1 if defined $ENV{PAR_TEMP} and $ENV{PAR_TEMP} =~ /(.+)/;
+ }
+@@ -98,8 +100,25 @@
+ next unless defined $path and -d $path and -w $path;
+ $temp_path = File::Spec->catdir($path, "par-$username");
+ ($temp_path) = $temp_path =~ /^(.*)$/s;
+- mkdir $temp_path, 0755;
++ unless (mkdir($temp_path, 0700) || $!{EEXIST}) {
++ warn "creation of private subdirectory $temp_path failed (errno=$!)";
++ return;
++ }
+
++ unless ($^O eq 'MSWin32') {
++ my @st;
++ unless (@st = lstat($temp_path)) {
++ warn "stat of private subdirectory $temp_path failed (errno=$!)";
++ return;
++ }
++ if (!S_ISDIR($st[2])
++ || $st[4] != $<
++ || ($st[2] & 0777) != 0700 ) {
++ warn "private subdirectory $temp_path is unsafe";
++ return;
++ }
++ }
++
+ last;
+ }
+ return $temp_path;
+
+
+Index: lib/PAR/SetupTemp.pm
+===================================================================
+--- lib/PAR/SetupTemp.pm (revision 1315)
++++ lib/PAR/SetupTemp.pm (revision 1316)
+@@ -114,7 +114,7 @@
+ if (!S_ISDIR($st[2])
+ || $st[4] != $<
+ || ($st[2] & 0777) != 0700 ) {
+- warn "private subdirectory $temp_path is unsafe";
++ warn "private subdirectory $temp_path is unsafe (please remove it and retry your operation)";
+ return;
+ }
+ }
diff --git a/perl-PAR.spec b/perl-PAR.spec
index fa7d29d..9d42f87 100644
--- a/perl-PAR.spec
+++ b/perl-PAR.spec
@@ -1,11 +1,13 @@
Name: perl-PAR
Version: 1.000
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: Perl Archive Toolkit
License: GPL+ or Artistic
Group: Development/Libraries
URL: http://search.cpan.org/dist/PAR/
Source0: http://www.cpan.org/authors/id/S/SM/SMUELLER/PAR-%{version}.tar.gz
+# Fix CVE-2011-4114, bug #760132, included in upstream 1.004.
+Patch0: perl-PAR-1.002-CVE-2011-4114.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildArch: noarch
BuildRequires: perl(Archive::Zip) >= 1
@@ -23,6 +25,7 @@ libraries from which Perl modules can be loaded.
%prep
%setup -q -n PAR-%{version}
+%patch0 -p0
%build
%{__perl} Makefile.PL INSTALLDIRS=vendor
@@ -39,7 +42,9 @@ find $RPM_BUILD_ROOT -depth -type d -exec rmdir {} 2>/dev/null \;
%{_fixperms} $RPM_BUILD_ROOT/*
%check
+export TEMP="$(mktemp -d)"
make test
+rm -rf "$TEMP"
%clean
rm -rf $RPM_BUILD_ROOT
@@ -51,6 +56,9 @@ rm -rf $RPM_BUILD_ROOT
%{_mandir}/man3/*
%changelog
+* Thu Dec 01 2011 Petr Pisar <ppisar@xxxxxxxxxx> - 1.000-3
+- Fix CVE-2011-4114 (insecure temporary directory handling) (bug #760132)
+
* Tue Aug 24 2010 Adam Tkac <atkac redhat com> - 1.000-2
- rebuild
--
Fedora Extras Perl SIG
http://www.fedoraproject.org/wiki/Extras/SIGs/Perl
perl-devel mailing list
perl-devel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/perl-devel
