-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
For Immediate Disclosure
============================== Summary ==============================
Security Alert: NOVL-2002-2963307
Title: Perl Handler Vulnerability Patch
Date: 20-Aug-2002
Revision: Original
Product Name: Perl version 5.003
OS/Platform(s): NetWare 5.1, 6
Reference URL: http://support.novell.com/servlet/tidfinder/2963307
Vendor Name: Novell, Inc.
Vendor URL: http://www.novell.com
Security Alerts: http://support.novell.com/security-alerts
Affects: Various on SYS: volume
Identifiers: None
Credits: Rain Forrest Puppy <rfp@wiretrip.net>
============================ Description ============================
The following code modifications are included in this patch:
Arbitrary perl code execution via POST.
Fix for, Perl -v displaying the version information.
Fix for %5c can be used to escape to higher level directories.
============================== Impact ===============================
This ZIP is applicable to both NetWare 5.1 and NetWare 6, running
Perl version 5.003 as a handler from a web server.
Type perl -version on server console to detect the version of Perl
The following items are included in this code change:
Arbitrary perl code execution.
Fix for, Perl -v displaying the version information.
Fix for %5c can be used to escape to higher level directories.
Note:
The systems having Perl version 5.6 need not apply above patch. Perl
5.6 already contains the fix for the above defect.
======================== Recommended Actions ========================
Note: The patch file is currently available as a BETA patch, which
means a user registration (no fee) is required to download the file.
This ZIP is applicable to both NetWare 5.1 and NetWare 6, running
Perl version 5.003
Type perl -version on server console to detect the version of Perl
The systems having Perl version 5.6 need not apply above patch. Perl
5.6 already contains the fix for the above defect.
See detailed instructions in the referenced Technical Information
Document (TID) http://support.novell.com/servlet/tidfinder/2963307.
============================ DISCLAIMER =============================
The content of this document is believed to be accurate at the time
of publishing based on currently available information. However, the
information is provided "AS IS" without any warranty or
representation. Your use of the document constitutes acceptance of
this disclaimer. Novell disclaims all warranties, express or implied,
regarding this document, including the warranties of merchantability
and fitness for a particular purpose. Novell is not liable for any
direct, indirect, or consequential loss or damage arising from use
of, or reliance on, this document or any security alert, even if
Novell has been advised of the possibility of such damages and even
if such damages are foreseeable.
============================ Appendices =============================
None
================ Contacting Novell Security Alerts ==================
To report suspected security vulnerabilities in Novell products, send
email to
secure@novell.com
PGP users may send signed/encrypted information to us using our PGP
key, available from the pgpkeys.mit.edu server, or our website at:
http://support.novell.com/security-alerts
Security Alerts, Novell, Inc. PGP Key Fingerprint:
F5AE 9265 0A34 F84E 580E 9B87 3AC1 1974 DE05 0FDB
========================= Revision History ==========================
Original: 13-Aug-2002 - Original Publication
Revised: 16-Aug-2002
Security Alert: 20-Aug-2002
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Security 7.0.3
iQA/AwUBPWJpKDrBGXTeBQ/bEQJxGgCfTQLybrIJOBweHMs7Gqn1SoxYuBgAoPzU
2rdww8TfTC5/jB44UjmJ16ud
=r+WG
-----END PGP SIGNATURE-----
