[Bug 1452050] New: CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050

            Bug ID: 1452050
           Summary: CVE-2016-10374 perltidy: Uses current working
                    directory without symlink-attack protection
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: anemec(a)redhat.com
                CC: jplesnik(a)redhat.com, paul(a)city-fan.org,
                    perl-devel(a)lists.fedoraproject.org,
                    perl-maint-list(a)redhat.com, ppisar(a)redhat.com,
                    psabata(a)redhat.com




perltidy relies on the current working directory for certain output files and
does not have a symlink-attack protection mechanism, which allows local users
to overwrite arbitrary files by creating a symlink, as demonstrated by creating
a perltidy.ERR symlink that the victim cannot delete.

References:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862667

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1452050] CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1452051



--- Comment #1 from Andrej Nemec <anemec(a)redhat.com&gt; ---
Created perltidy tracking bugs for this issue:

Affects: fedora-all [bug 1452051]


Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1452051
[Bug 1452051] CVE-2016-10374 perltidy: Uses current working directory
without symlink-attack protection [fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1452050] CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050
Bug 1452050 depends on bug 1452051, which changed state.

Bug 1452051 Summary: CVE-2016-10374 perltidy: Uses current working directory without
symlink-attack protection [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1452051

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1452050] CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050

Andrej Nemec <anemec(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1452052

Dhiru Kholia <dkholia(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dkholia(a)redhat.com



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1452050] CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050

Dhiru Kholia <dkholia(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|medium                      |low
         Whiteboard|impact=moderate,public=2016 |impact=low,public=20160813,
                   |0813,reported=20170514,sour |reported=20170514,source=de
                   |ce=debian,cvss3=5.5/CVSS:3. |bian,cvss3=2.8/CVSS:3.0/AV:
                   |0/AV:L/AC:L/PR:L/UI:N/S:U/C |L/AC:L/PR:L/UI:R/S:U/C:N/I:
                   |:N/I:H/A:N,fedora-all/perlt |L/A:N,fedora-all/perltidy=a
                   |idy=affected,rhel-6/perltid |ffected,rhel-6/perltidy=new
                   |y=new,rhel-7/perltidy=new   |,rhel-7/perltidy=new
           Severity|medium                      |low



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1452050] CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050

Dhiru Kholia <dkholia(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=low,public=20160813, |impact=low,public=20160813,
                   |reported=20170514,source=de |reported=20170514,source=de
                   |bian,cvss3=2.8/CVSS:3.0/AV: |bian,cvss3=2.8/CVSS:3.0/AV:
                   |L/AC:L/PR:L/UI:R/S:U/C:N/I: |L/AC:L/PR:L/UI:R/S:U/C:N/I:
                   |L/A:N,fedora-all/perltidy=a |L/A:N,fedora-all/perltidy=a
                   |ffected,rhel-6/perltidy=new |ffected,rhel-6/perltidy=new
                   |,rhel-7/perltidy=new        |,rhel-7/perltidy=wontfix



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1452050] CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050

Dhiru Kholia <dkholia(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |WONTFIX
         Whiteboard|impact=low,public=20160813, |impact=low,public=20160813,
                   |reported=20170514,source=de |reported=20170514,source=de
                   |bian,cvss3=2.8/CVSS:3.0/AV: |bian,cvss3=2.8/CVSS:3.0/AV:
                   |L/AC:L/PR:L/UI:R/S:U/C:N/I: |L/AC:L/PR:L/UI:R/S:U/C:N/I:
                   |L/A:N,fedora-all/perltidy=a |L/A:N,fedora-all/perltidy=a
                   |ffected,rhel-6/perltidy=new |ffected,rhel-6/perltidy=won
                   |,rhel-7/perltidy=wontfix    |tfix,rhel-7/perltidy=wontfi
                   |                            |x
        Last Closed|                            |2017-06-15 03:56:13



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1452050] CVE-2016-10374 perltidy: Uses current working directory without symlink-attack protection

https://bugzilla.redhat.com/show_bug.cgi?id=1452050



--- Comment #2 from Dhiru Kholia <dkholia(a)redhat.com&gt; ---
Statement:

Red Hat Product Security has rated this issue as having Low security impact.
This issue is not currently planned to be addressed in future updates. For
additional information, refer to the Issue Severity Classification:
https://access.redhat.com/security/updates/classification/ and Red Hat
Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.

-- 
You are receiving this mail because:
You are on the CC list for the bug.