Skip Menu |
 

This queue is for tickets about the IO-Compress CPAN distribution.

Report information
The Basics
Id: 116538
Status: resolved
Priority: 0/
Queue: IO-Compress

People
Owner: Nobody in particular
Requestors: TONYC [...] cpan.org
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: 2.070

Attachments


Subject: CVE-2016-1238: avoid loading optional modules from default .
Download (untitled) / with headers
text/plain 645b
Perl includes . at the end of @INC by default, if a user runs a program that loads IO::Uncompress::AnyUncompress while in a world-writable directory (such as /tmp) and any of the optional modules loaded in the BEGIN block in that file are not installed, an attacker can create that module in that directory to run code as the other user. To avoid this, temporarily remove . from the end of @INC while loading optional modules. zipdetails uses Encode, which has the same problem with Encode::ConfigLocal. To avoid this, remove . from @INC at the start of zipdetails. These changes are included in maint-5.22, maint-5.24 and blead perl. Tony
Subject: IO-Compress-cve-2016-1238.patch
diff -ru IO-Compress-2.069-orig/bin/zipdetails IO-Compress-2.069/bin/zipdetails --- IO-Compress-2.069-orig/bin/zipdetails 2014-01-31 07:52:56.000000000 +1100 +++ IO-Compress-2.069/bin/zipdetails 2016-07-28 10:10:17.812926303 +1000 @@ -5,6 +5,7 @@ # Display info on the contents of a Zip file # +BEGIN { pop @INC if $INC[-1] eq '.' } use strict; use warnings ; diff -ru IO-Compress-2.069-orig/lib/IO/Uncompress/AnyUncompress.pm IO-Compress-2.069/lib/IO/Uncompress/AnyUncompress.pm --- IO-Compress-2.069-orig/lib/IO/Uncompress/AnyUncompress.pm 2015-09-27 04:34:31.000000000 +1000 +++ IO-Compress-2.069/lib/IO/Uncompress/AnyUncompress.pm 2016-07-28 10:08:45.064332089 +1000 @@ -27,6 +27,8 @@ BEGIN { + local @INC = @INC; + pop @INC if $INC[-1] eq '.'; eval ' use IO::Uncompress::Adapter::Inflate 2.069 ;'; eval ' use IO::Uncompress::Adapter::Bunzip2 2.069 ;'; eval ' use IO::Uncompress::Adapter::LZO 2.069 ;';
Download (untitled) / with headers
text/plain 187b
I've my development copy of zipdetails to match what in bleedperl, but I don't see the change to AnyUncompress.pm in bleed. Would prefer to keep in-sync. Is that part still needed? Paul
Subject: Re: [rt.cpan.org #116538] CVE-2016-1238: avoid loading optional modules from default .
Date: Mon, 12 Sep 2016 10:50:57 +1000
To: Paul Marquess via RT <bug-IO-Compress [...] rt.cpan.org>
From: tonyc [...] cpan.org
Download (untitled) / with headers
text/plain 557b
On Sun, Sep 11, 2016 at 02:56:09PM -0400, Paul Marquess via RT wrote: Show quoted text
> <URL: https://rt.cpan.org/Ticket/Display.html?id=116538 > > > I've my development copy of zipdetails to match what in bleedperl, but I don't see the change to AnyUncompress.pm in bleed. > > Would prefer to keep in-sync. Is that part still needed?
It's in blead: http://perl5.git.perl.org/perl.git/blob/HEAD:/cpan/IO-Compress/lib/IO/Uncompress/AnyUncompress.pm#l29 Introduced in: http://perl5.git.perl.org/perl.git/commitdiff/b8097e9479a0aafd1182244c6f9a955c57fb6b1a#patch8 Tony
Download (untitled) / with headers
text/plain 792b
On Sun Sep 11 20:51:09 2016, TONYC wrote: Show quoted text
> On Sun, Sep 11, 2016 at 02:56:09PM -0400, Paul Marquess via RT wrote:
> > <URL: https://rt.cpan.org/Ticket/Display.html?id=116538 > > > > > I've my development copy of zipdetails to match what in bleedperl, > > but I don't see the change to AnyUncompress.pm in bleed. > > > > Would prefer to keep in-sync. Is that part still needed?
> > It's in blead: > > http://perl5.git.perl.org/perl.git/blob/HEAD:/cpan/IO- > Compress/lib/IO/Uncompress/AnyUncompress.pm#l29 > > Introduced in: > > http://perl5.git.perl.org/perl.git/commitdiff/b8097e9479a0aafd1182244c6f9a955c57fb6b1a#patch8 > > Tony
Hmm, not 100% sure how I convinced myself that it wasn't in blead, but I was obviously deluding myself. :-) Change applied to my development copy Paul


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.