-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 431-1 security@debian.org http://www.debian.org/security/ Matt Zimmerman February 1st, 2004 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : perl Vulnerability : information leak Problem-Type : local Debian-specific: no CVE Ids : CAN-2003-0618 Paul Szabo discovered a number of similar bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files (such as testing for their existence and some of their permissions) that should not be accessible to unprivileged users. For the current stable distribution (woody) this problem has been fixed in version 5.6.1-8.6. For the unstable distribution, this problem will be fixed soon. Refer to Debian bug #220486. We recommend that you update your perl package if you have the "perl-suid" package installed. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6.dsc Size/MD5 checksum: 687 bd35315af2ee330a38878fc2def3944f http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6.diff.gz Size/MD5 checksum: 139694 0533eac1df4898c6279faa28e480bb12 http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1.orig.tar.gz Size/MD5 checksum: 5983695 ec1ff15464809b562aecfaa2e65edba6 Architecture independent components: http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.6.1-8.6_all.deb Size/MD5 checksum: 30928 b5b74268eb7f4b6dd727f3eacff8640d http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.6.1-8.6_all.deb Size/MD5 checksum: 3885968 7016b67f69129086332af3b64c396dd4 http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.6.1-8.6_all.deb Size/MD5 checksum: 1278620 7b18677dd04c0c7cde961071847ac291 Alpha architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_alpha.deb Size/MD5 checksum: 619274 64c7916a7d2ba38090c46c7d4ee10822 http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_alpha.deb Size/MD5 checksum: 435172 281bf36b67c5df4c63e6f6976d70b8ff http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_alpha.deb Size/MD5 checksum: 1217510 68c2cb3bbe1c165d3ee95527518224db http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_alpha.deb Size/MD5 checksum: 208642 fd10a9f87fe3a45a47949af80d949555 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_alpha.deb Size/MD5 checksum: 2827198 e556feac99eab3d85e4c50c533289100 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_alpha.deb Size/MD5 checksum: 34788 51e75610d765d63e9cb1d1fe5249aa21 ARM architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_arm.deb Size/MD5 checksum: 516188 eb9451faccbae1460280421ae992cbd1 http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_arm.deb Size/MD5 checksum: 362586 617431f74e9743d095639384414972b9 http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_arm.deb Size/MD5 checksum: 1164116 98cee566975f346bac927407fe4201db http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_arm.deb Size/MD5 checksum: 545052 b2539e3721d4c96dca0c2716e37e56a1 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_arm.deb Size/MD5 checksum: 2306932 8978bbaf710e764e0c6b8f960f1e4ea9 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_arm.deb Size/MD5 checksum: 29366 68e93e86c809d2c10761bf2f91f36cf2 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_i386.deb Size/MD5 checksum: 424278 1444bf03767d0f9c10807177a93370f9 http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_i386.deb Size/MD5 checksum: 347600 425b862961b08e332bbccbcfb6536a9e http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_i386.deb Size/MD5 checksum: 1150162 82b0d936fee5e593e3f6980a3286135a http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_i386.deb Size/MD5 checksum: 496154 f151d8b68838e9187f6a46dda180365a http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_i386.deb Size/MD5 checksum: 2119560 f801a12de6caa10345ce05b7ec9abd35 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_i386.deb Size/MD5 checksum: 28558 6b3c806457336af2273d307439bc6d16 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_ia64.deb Size/MD5 checksum: 703464 3e989928ddda2fc675e28061ca991a7f http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_ia64.deb Size/MD5 checksum: 598652 251fdfd551ba34a6f73e62e691e4d287 http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_ia64.deb Size/MD5 checksum: 1266338 fdd1c42a03d0110ae07bc5d2e4bd28a4 http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_ia64.deb Size/MD5 checksum: 226452 0564ec7380e411cb26659e6e7af0a356 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_ia64.deb Size/MD5 checksum: 3312394 429e58b00f1a376e36b341a0769f9da1 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_ia64.deb Size/MD5 checksum: 45288 c82406b3c40ffbc0e9570c5a5fd0c0d9 HP Precision architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_hppa.deb Size/MD5 checksum: 622788 14f5a54ae931892976b32b3166d6dc5a http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_hppa.deb Size/MD5 checksum: 473302 19c8fe7ff21ffae689779bf0315ae5de http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_hppa.deb Size/MD5 checksum: 1211408 d53b60c9903b5195fcc8336e19dc5445 http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_hppa.deb Size/MD5 checksum: 208542 fdc9005ca47673fa1ce5366a4b66715b http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_hppa.deb Size/MD5 checksum: 2288086 985b97c0272f892649c1d23b39455299 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_hppa.deb Size/MD5 checksum: 34008 b4693a9afdd7c9110ab191db2c9b02e3 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_m68k.deb Size/MD5 checksum: 399416 c3efcf986c92577053b2ba39364977f7 http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_m68k.deb Size/MD5 checksum: 331920 87e7bde0efc88f3a85edb43c3fc27613 http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_m68k.deb Size/MD5 checksum: 1149342 f89abf6dbc2dcd8b8a1a4c1305f00eee http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_m68k.deb Size/MD5 checksum: 192286 ffaad227931eec6b31cde281a1e9cbc7 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_m68k.deb Size/MD5 checksum: 2132006 d2b4a3719d29b4057a605cd7eaf98ab0 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_m68k.deb Size/MD5 checksum: 27702 db0f7e6fa62fbe2cefdef049e981077f Big endian MIPS architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_mips.deb Size/MD5 checksum: 522406 d4f34c5a8cdbe770b2e74c88b0fa3471 http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_mips.deb Size/MD5 checksum: 364574 151c040c462de60583c460719d3134f7 http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_mips.deb Size/MD5 checksum: 1159042 b82b068f293d1623248770a23474636f http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_mips.deb Size/MD5 checksum: 185858 1e6acdb86ab513460ecb90fa4d40e976 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_mips.deb Size/MD5 checksum: 2408588 784f1709696618e54ab0ae9374ec62ea http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_mips.deb Size/MD5 checksum: 29030 9ece42859132d8f4ff42fc1f35ec0903 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_mipsel.deb Size/MD5 checksum: 516108 86d2f86ecb931dccaf14bbd5a44b35e9 http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_mipsel.deb Size/MD5 checksum: 361216 79e65172b12342de108408c511baadaf http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_mipsel.deb Size/MD5 checksum: 1160154 b94317990ee11e0b31ad2514ce34ffb3 http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_mipsel.deb Size/MD5 checksum: 185364 d8b417b640456b47f2d9703f2900eaf8 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_mipsel.deb Size/MD5 checksum: 2265642 982d4c63dd056ce92167381a4bb592e6 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_mipsel.deb Size/MD5 checksum: 28650 df09f64016328dbd143aff5064f667a9 PowerPC architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_powerpc.deb Size/MD5 checksum: 567202 16f018ff6f78c62e0b520fce3e907b8f http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_powerpc.deb Size/MD5 checksum: 400508 2fd45f8ec310bd5c9e6fe51439decc4c http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_powerpc.deb Size/MD5 checksum: 1183284 9c0fb53d10dbe9cfaa6f40f673b1ebea http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_powerpc.deb Size/MD5 checksum: 202272 f33058f98a33fda59933e5d6d7a71e67 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_powerpc.deb Size/MD5 checksum: 2300386 ac70adfde40e1e653769c6461c2a9c06 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_powerpc.deb Size/MD5 checksum: 30696 3db633d8098c27c3aee470d15c47ce81 IBM S/390 architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_s390.deb Size/MD5 checksum: 456072 f064b7b26f2af394c2dd60cec032da0d http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_s390.deb Size/MD5 checksum: 404838 d1cf256b12ce0769b4235c3510768321 http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_s390.deb Size/MD5 checksum: 1167848 84e4ab8cff1215c4c1d6642613eda901 http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_s390.deb Size/MD5 checksum: 191326 7f01044d582b918c10890ffa19719629 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_s390.deb Size/MD5 checksum: 2210444 a994760dbe9770b5b09dfd79c811e3ad http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_s390.deb Size/MD5 checksum: 32824 1e69e4873314aed20741760d51dacc9e Sun Sparc architecture: http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.6_sparc.deb Size/MD5 checksum: 528768 f81618d37a056e4f9b9e1ba31be41cf1 http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.6_sparc.deb Size/MD5 checksum: 403138 f8ac063a401394fd3ddb2b0c73cb7eb3 http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.6_sparc.deb Size/MD5 checksum: 1191704 fd6ffbfb0acb0a61ba71ec5e89ea186d http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.6_sparc.deb Size/MD5 checksum: 211146 97f6ab1229f1c4bae992d15fc8a7a730 http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.6_sparc.deb Size/MD5 checksum: 2284874 67d705c68dc8426f8c3cd411c264e5d5 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.6_sparc.deb Size/MD5 checksum: 30924 e2d4b57903ab3c65e9f81c49cda97009 These files will probably be moved into the stable distribution on its next revision. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFAHMMcArxCt0PiXR4RAtQkAKCUDTeQYKS+EJUW/lrOLiqmk56MEgCfYf52 2406x+Hg0Dilsz/SzCDY1y8= =MfIU -----END PGP SIGNATURE-----