On Mon, 16 Jan 2006, Sisyphus wrote: On Tue, 17 Jan 2006, "Chris Wagner"
<[EMAIL PROTECTED]> wrote:
> > Just received a security advisory for Perl. Any word on an
> > ActiveState vulnerability?
> >
>
> Just a little bit curious about that. Do you have any more info ? The
> message you posted doesn't really tell us much. (It's a bit like our
> local TV news service which tells us things like "a man died today in
> a car accident" .... and leaves it at that :-)
>
> I'm specifically wondering which version of perl it is, and whether
> they submitted a perlbug report - plus I'd be interested to see any
> other available info.
This affects all recent Perl versions, including all 5.8 version.
Here is some more information:
http://dyadsecurity.com/perl-0002.html
The fix in the advisory is not really correct; better fixes have
been applied to both the 5.8 and 5.9 tracks in the Perl repository.
> I would think it possible that it's something limited to (various
> flavours of) *nix only.
It affects all platforms, but the only known exploit is for Webmin, a
Unix web administration tool. This bug can only be exploited if an
attacker can specify the *format* string passed to printf() or
sprintf().
This bug and related issues are fixed in Perl 5.8.8 which will be
released in a couple of weeks.
Cheers,
-Jan
_______________________________________________
Perl-Win32-Users mailing list
[email protected]
To unsubscribe: http://listserv.ActiveState.com/mailman/mysubs
