CVE-1999-1386: Medium severity larry wall perl vulnerability
Perl 5.00404 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not run Perl with the -e command-line option, as Perl 5.004_04 and earlier follows symbolic links when run with -e and can be abused to overwrite arbitrary files via /tmp/perl-eaXXXXX.
Perl -e option (command-line) = avoid use - Compensating control
Prevent unprivileged users from creating or controlling symlinks in /tmp. Restrict write access to /tmp (or otherwise isolate writable temp directories) to mitigate symlink attacks against /tmp/perl-eaXXXXX.
- Operational
Inspect /tmp for files named perl-ea* (e.g., /tmp/perl-eaXXXXX), remove unexpected symlinks or files, and verify/restore any files that may have been overwritten by the attack.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1386?
CVE-1999-1386 is classified as a medium severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-1999-1386?
To fix CVE-1999-1386, upgrade to Perl version 5.004_05 or later, which addresses the symbolic link following issue.
Who is affected by CVE-1999-1386?
Users running Perl versions 5.004_04 and earlier on systems that allow local users to create symbolic links are affected by CVE-1999-1386.
What types of attacks can CVE-1999-1386 enable?
CVE-1999-1386 can enable local users to perform symlink attacks, potentially allowing them to overwrite arbitrary files.
Is CVE-1999-1386 still relevant today?
While CVE-1999-1386 refers to an older vulnerability, it remains relevant for legacy systems still running affected versions of Perl.