=========================================================== Ubuntu Security Notice USN-222-2 December 12, 2005 perl vulnerability CVE-2005-3962 ===========================================================
A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: libperl5.8 perl-base The problem can be corrected by upgrading the affected package to version 5.8.4-2ubuntu0.6 (for Ubuntu 4.10), 5.8.4-6ubuntu1.2 (for Ubuntu 5.04), or 5.8.7-5ubuntu1.2 (for Ubuntu 5.10). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: USN-222-1 fixed a vulnerability in the Perl interpreter. It was discovered that the version of USN-222-1 was not sufficient to handle all possible cases of malformed input that could lead to arbitrary code execution, so another update is necessary. Original advisory: Jack Louis of Dyad Security discovered that Perl did not sufficiently check the explicit length argument in format strings. Specially crafted format strings with overly large length arguments led to a crash of the Perl interpreter or even to execution of arbitrary attacker-defined code with the privileges of the user running the Perl program. However, this attack was only possible in insecure Perl programs which use variables with user-defined values in string interpolations without checking their validity. Updated packages for Ubuntu 4.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-2ubuntu0.6.diff.gz Size/MD5: 65287 5b3e19646e2091eb9294220d0f7db14f http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-2ubuntu0.6.dsc Size/MD5: 727 f56ec1862af2a154066ea04d950ae74c http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4.orig.tar.gz Size/MD5: 12094233 912050a9cb6b0f415b76ba56052fb4cf Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/universe/p/perl/libcgi-fast-perl_5.8.4-2ubuntu0.6_all.deb Size/MD5: 37120 34c8f6b057066ed0b5e07ac1a4b783b6 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-doc_5.8.4-2ubuntu0.6_all.deb Size/MD5: 7049588 2e0dedeaf0d5ebb7f5db7b0fc7885993 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-modules_5.8.4-2ubuntu0.6_all.deb Size/MD5: 2181262 d51dcf8f5d749b48a95111e334e19e40 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.4-2ubuntu0.6_amd64.deb Size/MD5: 605672 c5af1be0954268bd9dec4b350a5f6e60 http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.4-2ubuntu0.6_amd64.deb Size/MD5: 1032 fda7bcbdfdc9edce6299dafa80cf8af9 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.4-2ubuntu0.6_amd64.deb Size/MD5: 787486 379267d6352e32ea9c19705632aa31ff http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.4-2ubuntu0.6_amd64.deb Size/MD5: 3820376 216a2a3838f56e5d130efb6bc81216ec http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.4-2ubuntu0.6_amd64.deb Size/MD5: 32970 12370fa42f20842b0f1e2700d8becef6 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-2ubuntu0.6_amd64.deb Size/MD5: 3834442 7716de916cd192cb0994880f7edc7c32 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.4-2ubuntu0.6_i386.deb Size/MD5: 547084 1adfa9c3510df872ca4002d90e6ebf0f http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.4-2ubuntu0.6_i386.deb Size/MD5: 494308 2744b8ac7f93c771240b12fb4d02b36e http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.4-2ubuntu0.6_i386.deb Size/MD5: 727906 7f2faf7b54a7e0398c807a46f0c17817 http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.4-2ubuntu0.6_i386.deb Size/MD5: 3631738 82ad474e7516dec454da629a93128848 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.4-2ubuntu0.6_i386.deb Size/MD5: 30930 eed03dfcc0265086b8e009ab614041ba http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-2ubuntu0.6_i386.deb Size/MD5: 3229914 6be57f704821ee42e2da1580da7b68f5 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.4-2ubuntu0.6_powerpc.deb Size/MD5: 561444 65381c155d8b7a4c2b3ae8d0ee8f4343 http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.4-2ubuntu0.6_powerpc.deb Size/MD5: 1040 731ffc922ffd0879497c1b5ff1628b6a http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.4-2ubuntu0.6_powerpc.deb Size/MD5: 718886 0dd2fb65fd29067c751d523a4800363c http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.4-2ubuntu0.6_powerpc.deb Size/MD5: 3817978 72d094eb38100698b1aae1deeb58bffb http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.4-2ubuntu0.6_powerpc.deb Size/MD5: 30802 9a423971bbd7b4cef1bfdb2a7fd54d87 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-2ubuntu0.6_powerpc.deb Size/MD5: 3477346 4d6f4b5ca1839ae4234186aa02e8e7c5 Updated packages for Ubuntu 5.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-6ubuntu1.2.diff.gz Size/MD5: 89318 a3a73738a8b8efd75aa182cd13fb1860 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-6ubuntu1.2.dsc Size/MD5: 744 1e017e411a53677367e87b8c3a4046d3 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4.orig.tar.gz Size/MD5: 12094233 912050a9cb6b0f415b76ba56052fb4cf Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/universe/p/perl/libcgi-fast-perl_5.8.4-6ubuntu1.2_all.deb Size/MD5: 37922 dffd4fc6f386b1c5f11c4600dce7ad5c http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-doc_5.8.4-6ubuntu1.2_all.deb Size/MD5: 7049702 c8d70cd6675866f6ac525bd6ac52a99b http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-modules_5.8.4-6ubuntu1.2_all.deb Size/MD5: 2178092 873559d5d60c08e2a8375e6a96990e53 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.4-6ubuntu1.2_amd64.deb Size/MD5: 605680 f0275ed35fbda6bd944b26b77ee6355b http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.4-6ubuntu1.2_amd64.deb Size/MD5: 1030 207e8a400a8859ecf33e62f4cceaba80 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.4-6ubuntu1.2_amd64.deb Size/MD5: 791310 df53b2d65ed91ba0344d503380492203 http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.4-6ubuntu1.2_amd64.deb Size/MD5: 3826158 7d54efef54b674ffdeb4b1e75063e2fc http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.4-6ubuntu1.2_amd64.deb Size/MD5: 32980 97fe9bf54cd382f7b09560de76b5d856 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-6ubuntu1.2_amd64.deb Size/MD5: 3834148 fa33b977bfad84fd5c339ac6a8a4fc3e i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.4-6ubuntu1.2_i386.deb Size/MD5: 547306 01af9e7e1523f8667e35554cc615c26c http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.4-6ubuntu1.2_i386.deb Size/MD5: 494410 62a8334b0f3283304ba6dc29287bfb8e http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.4-6ubuntu1.2_i386.deb Size/MD5: 731186 7585a3909732bfc9557e6cb24f8f85ed http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.4-6ubuntu1.2_i386.deb Size/MD5: 3631248 49e47efb7b7e24c6d2f0b00780af2627 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.4-6ubuntu1.2_i386.deb Size/MD5: 30600 46e198ea02ca26ff218fb8c8def02173 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-6ubuntu1.2_i386.deb Size/MD5: 3230238 8a2c08cab7a8fa713f872c20f7b3003f powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.4-6ubuntu1.2_powerpc.deb Size/MD5: 625376 0ac8f25e544be1a5cd06d3f7655ab778 http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.4-6ubuntu1.2_powerpc.deb Size/MD5: 1040 ebb0abd127bdc4c3c2aa875f76a9de44 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.4-6ubuntu1.2_powerpc.deb Size/MD5: 789820 653b717cc511a48834fb855241f9895a http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.4-6ubuntu1.2_powerpc.deb Size/MD5: 3589148 90fd48da735eec46c83dffe53141599e http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.4-6ubuntu1.2_powerpc.deb Size/MD5: 33710 ac7663a3041b364dc7304789f166089d http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.4-6ubuntu1.2_powerpc.deb Size/MD5: 3509404 282cf6cd561f85770a0bf16850d62aed Updated packages for Ubuntu 5.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.7-5ubuntu1.2.diff.gz Size/MD5: 138676 cb9f0e6ee16706a0a57803f5418cee85 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.7-5ubuntu1.2.dsc Size/MD5: 724 4d821dbd55312a6cda028ea4b2b01a71 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.7.orig.tar.gz Size/MD5: 12512211 dacefa1fe3c5b6d7bbc334ad94826131 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/universe/p/perl/libcgi-fast-perl_5.8.7-5ubuntu1.2_all.deb Size/MD5: 39204 13ee742f2116e1c59001c059358f49d1 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-doc_5.8.7-5ubuntu1.2_all.deb Size/MD5: 7206780 3734f65b71a70fef5dda18026153d901 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-modules_5.8.7-5ubuntu1.2_all.deb Size/MD5: 2325762 c0febd1257a462bc183633c12f97a9d2 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.7-5ubuntu1.2_amd64.deb Size/MD5: 641396 cb669098bbe1dda4d985fc1abeb52b5a http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.7-5ubuntu1.2_amd64.deb Size/MD5: 1008 df31ac411ee5b5cdcc679e49c231614d http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.7-5ubuntu1.2_amd64.deb Size/MD5: 819760 0c34e32ade8fac53356dbf95649cfcee http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.7-5ubuntu1.2_amd64.deb Size/MD5: 2689940 eefe91d7d1aee78b6d84ee8044556120 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.7-5ubuntu1.2_amd64.deb Size/MD5: 31540 5806879f51b79ba373eac29b7633e245 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.7-5ubuntu1.2_amd64.deb Size/MD5: 3974988 c9dd927bd39c72606146c3de7fec7f18 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.7-5ubuntu1.2_i386.deb Size/MD5: 560316 eb964f53d00d5e16f0d074460a6d7315 http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.7-5ubuntu1.2_i386.deb Size/MD5: 505994 d88e73bf59e859a0efecca42c6524157 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.7-5ubuntu1.2_i386.deb Size/MD5: 737720 8df8b2936b3189d9d37586f275096146 http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.7-5ubuntu1.2_i386.deb Size/MD5: 2454466 2ddeabe8c468d800cbbac03ce0e2d454 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.7-5ubuntu1.2_i386.deb Size/MD5: 29052 71fb8a9e0b8cb4a5bb568c8cf8610153 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.7-5ubuntu1.2_i386.deb Size/MD5: 3297206 3761f58400331261204a53322eabe79c powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl-dev_5.8.7-5ubuntu1.2_powerpc.deb Size/MD5: 656200 b5fb5ff99cadcd80a223b1ba3c94ba46 http://security.ubuntu.com/ubuntu/pool/main/p/perl/libperl5.8_5.8.7-5ubuntu1.2_powerpc.deb Size/MD5: 1012 f9de5ed600bb12059ac36743ce6d054d http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-base_5.8.7-5ubuntu1.2_powerpc.deb Size/MD5: 814884 7041e0d43fafd9c778eac766a3f87cc4 http://security.ubuntu.com/ubuntu/pool/universe/p/perl/perl-debug_5.8.7-5ubuntu1.2_powerpc.deb Size/MD5: 2646988 44c2ec940009faddc95cdcb347cb520c http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl-suid_5.8.7-5ubuntu1.2_powerpc.deb Size/MD5: 32164 18bcb6924eaffe0bb176e21d62e099c0 http://security.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.8.7-5ubuntu1.2_powerpc.deb Size/MD5: 3657600 0511cf2341c18998acab022212f02f02
signature.asc
Description: Digital signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/