Skip Menu |
 

This queue is for tickets about the Sys-Hostname-Long CPAN distribution.

Report information
The Basics
Id: 59833
Status: open
Priority: 0/
Queue: Sys-Hostname-Long

People
Owner: Nobody in particular
Requestors: zdenek.styblik [...] gmail.com
Cc:
AdminCc:

Bug Information
Severity: Important
Broken in:
  • 1.4
  • 1.5
Fixed in: (no value)



Subject: Sys-Hostname-Long bug with -T switch
Download (untitled) / with headers
text/plain 757b
Hello, due to exec of external commands, namely hostname, Sys-Hostname-Long gets evaluated as "insecure use". Insecure $ENV{PATH} while running with -T switch at /usr/lib64/perl5/site_perl/5.10.1/Sys/Hostname/Long.pm line XX. The line number varies, but it's around 7x - lines with % su; and % hostname; commands follow. The fix is to define $ENV{PATH}, question is how to satisfy everyone. I've fixed this by setting $ENV{PATH} = '/bin/'. Tested with: Linux darkstar 2.6.31.7 #1 SMP Mon Dec 14 17:36:17 CET 2009 x86_64 AMD Athlon(tm) Dual Core Processor 5050e AuthenticAMD GNU/Linux This is perl, v5.10.1 (*) built for x86_64-linux-thread-multi I've tested this from CGI and CLI (-T). Sys-Hostname-Long is used by other packages in this case. Zdenek
Subject: Re: [rt.cpan.org #59833] Sys-Hostname-Long bug with -T switch
Date: Fri, 30 Jul 2010 10:33:47 +1000
To: bug-Sys-Hostname-Long [...] rt.cpan.org
From: Scott Penrose <scott [...] dd.com.au>
Download (untitled) / with headers
text/plain 1.2k
Thanks. I will apply the patch. Scott On 30/07/2010, at 4:56 AM, Zdenek Styblik via RT wrote: Show quoted text
> Thu Jul 29 14:56:20 2010: Request 59833 was acted upon. > Transaction: Ticket created by stybla > Queue: Sys-Hostname-Long > Subject: Sys-Hostname-Long bug with -T switch > Broken in: 1.4 > Severity: Important > Owner: Nobody > Requestors: zdenek.styblik@gmail.com > Status: new > Ticket <URL: https://rt.cpan.org/Ticket/Display.html?id=59833 > > > > Hello, > > due to exec of external commands, namely hostname, Sys-Hostname-Long > gets evaluated as "insecure use". > > Insecure $ENV{PATH} while running with -T switch at > /usr/lib64/perl5/site_perl/5.10.1/Sys/Hostname/Long.pm line XX. > > The line number varies, but it's around 7x - lines with % su; and % > hostname; commands follow. > The fix is to define $ENV{PATH}, question is how to satisfy everyone. > I've fixed this by setting $ENV{PATH} = '/bin/'. > > Tested with: > Linux darkstar 2.6.31.7 #1 SMP Mon Dec 14 17:36:17 CET 2009 x86_64 AMD > Athlon(tm) Dual Core Processor 5050e AuthenticAMD GNU/Linux > > This is perl, v5.10.1 (*) built for x86_64-linux-thread-multi > > I've tested this from CGI and CLI (-T). Sys-Hostname-Long is used by > other packages in this case. > > Zdenek
Download smime.p7s
application/pkcs7-signature 3.7k

Message body not shown because it is not plain text.

Download (untitled) / with headers
text/plain 1.4k
The problem still exists with 1.5 On 2010-07-29 20:34:00, scott@dd.com.au wrote: Show quoted text
> Thanks. I will apply the patch. > > Scott > > On 30/07/2010, at 4:56 AM, Zdenek Styblik via RT wrote: >
> > Thu Jul 29 14:56:20 2010: Request 59833 was acted upon. > > Transaction: Ticket created by stybla > > Queue: Sys-Hostname-Long > > Subject: Sys-Hostname-Long bug with -T switch > > Broken in: 1.4 > > Severity: Important > > Owner: Nobody > > Requestors: zdenek.styblik@gmail.com > > Status: new > > Ticket <URL: https://rt.cpan.org/Ticket/Display.html?id=59833 > > > > > > > Hello, > > > > due to exec of external commands, namely hostname, Sys-Hostname-Long > > gets evaluated as "insecure use". > > > > Insecure $ENV{PATH} while running with -T switch at > > /usr/lib64/perl5/site_perl/5.10.1/Sys/Hostname/Long.pm line XX. > > > > The line number varies, but it's around 7x - lines with % su; and % > > hostname; commands follow. > > The fix is to define $ENV{PATH}, question is how to satisfy everyone. > > I've fixed this by setting $ENV{PATH} = '/bin/'. > > > > Tested with: > > Linux darkstar 2.6.31.7 #1 SMP Mon Dec 14 17:36:17 CET 2009 x86_64 AMD > > Athlon(tm) Dual Core Processor 5050e AuthenticAMD GNU/Linux > > > > This is perl, v5.10.1 (*) built for x86_64-linux-thread-multi > > > > I've tested this from CGI and CLI (-T). Sys-Hostname-Long is used by > > other packages in this case. > > > > Zdenek
>


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.