REDHAT-BUG-1051108: Medium severity Perl PlRPC vulnerability
PlRPC is a Perl module that implements IDL-free RPCs. It is intended for cross-domain applications, but it fails to achieve that goal because it uses Storable, which is known to be insecure when deserializing (thawing) untrusted data. User name and password are transmitted using Storable, so code execution can happen before authentication.
The patches that exist just document the issues and are not real fixes.
References: http://seclists.org/oss-sec/2014/q1/56 https://rt.cpan.org/Public/Bug/Display.html?id=90474
Commit/Patch: http://pkgs.fedoraproject.org/cgit/perl-PlRPC.git/commit/?id=b9497b8d780a54ff5be6661c5f24d70135e0bb79
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1051108?
The severity of REDHAT-BUG-1051108 is critical due to the insecure deserialization vulnerability that can lead to remote code execution.
How do I fix REDHAT-BUG-1051108?
To fix REDHAT-BUG-1051108, update the Perl PlRPC module to the latest version that addresses the vulnerability.
What are the potential impacts of REDHAT-BUG-1051108?
The potential impacts of REDHAT-BUG-1051108 include unauthorized access to user credentials and execution of arbitrary code.
Who is affected by REDHAT-BUG-1051108?
Affected users of REDHAT-BUG-1051108 include those using the Perl PlRPC module, especially in applications that handle untrusted data.
What should I do if I cannot update due to REDHAT-BUG-1051108?
If you cannot update due to REDHAT-BUG-1051108, consider isolating affected systems or implementing strict input validation to mitigate risks.