CVE-2004-0452: Race Condition
Published Dec 21, 2004
·Updated
Race condition in the rmtree function in the File::Path module in Perl 5.6.1 and 5.8.4 sets read/write permissions for the world, which allows local users to delete arbitrary files and directories, and possibly read files and directories, via a symlink attack.
Affected Software
2 affected components
Larry Wall Perl=5.8.4
Larry Wall Perl=5.6.1
Remediation
Patch Available
Patch Available
Patch Available
Event History
Dec 21, 2004
CVE Published
05:00 AM
Dec 31, 2004
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0452?
CVE-2004-0452 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2004-0452?
To fix CVE-2004-0452, upgrade Perl to a version later than 5.8.4.
3
Who is affected by CVE-2004-0452?
CVE-2004-0452 affects users running Perl version 5.6.1 or 5.8.4.
4
What exploitation methods are possible with CVE-2004-0452?
CVE-2004-0452 can be exploited through a symlink attack allowing local users to delete or read files they shouldn't access.
5
Is there a workaround for CVE-2004-0452?
Disabling or restricting the use of the affected File::Path module can serve as a temporary workaround for CVE-2004-0452.