CVE-2010-1168: High severity safe vulnerability
Safe.pm 2.24 and earlier, when used in Perl 5.10.0 and earlier, may allow attackers to break out of safe compartment in (1) Safe::reval or (2) Safe::rdo using implicitly called methods (such as DESTROY or AUTOLOAD) on implicitly blessed Perl objects, returned as a result of unsafe code evaluation. These methods could have been executed unrestricted by Safe, when such objects were accessed or destroyed. If a victim was tricked into running a specially-crafted Perl script, using Safe extension module, it could lead to intended Safe module restriction bypass. Different vulnerability than CVE-2010-1447.
Solution: Upgrade to Safe.pm v2.25 or higher.
References: [1] http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm
Acknowledgements:
Red Hat would like to thank Tim Bunce for responsibly reporting this issue. Upstream acknowledges Nick Cleaton as the original reporter.
Other sources
The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects, as demonstrated by the (a) DESTROY and (b) AUTOLOAD methods, related to "automagic methods."
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What are the potential risks associated with CVE-2010-1168?
CVE-2010-1168 allows attackers to bypass access restrictions in the Safe module for Perl, potentially leading to the injection and execution of arbitrary code.
How can I remediate CVE-2010-1168?
To fix CVE-2010-1168, you should upgrade to Safe module version 2.25 or later.
Which versions of the Safe module are affected by CVE-2010-1168?
CVE-2010-1168 affects Safe module versions before 2.25, including 2.08 through 2.24.
What Perl versions are vulnerable to CVE-2010-1168?
Perl versions 5.8.5-53.el4 and 5.8.8-32.el5_5.1 are among those that can have the vulnerability due to the affected Safe module.
What is the main attack vector for CVE-2010-1168?
The main attack vector for CVE-2010-1168 involves calling methods and using objects in a way that circumvents Safe module restrictions.