Package: sudo
Severity: important
Tags: security
Quoting from http://www.sudo.ws/sudo/alerts/perl_env.html :
| The PERL5LIB and PERLLIB environment variables can be used to provide a list
of
| directories in which to look for perl library files before the system
directories are
| searched. It is similar in concept to the LD_LIBRARY_PATH environment
variables, only for
| perl. These variables are ignored if "tainting" is enabled (via the -T
switch). The
| PERL5OPT environment variable specifies additional command line options to be
passed to
| the script which may modify its behavior.
|
| Malicious users with sudo access to run a perl script can use these variables
to include
| and execute their own library file with the same name as a system library
file that is
| included (via the "use" or "require" directives) by the perl script run via
sudo.
It's been fixed upstream in 1.6.8p12.
Cheers,
Moritz
-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-2-686
Locale: LANG=C, [EMAIL PROTECTED] (charmap=ISO-8859-15)
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
