Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister
 
PerlMonks  

Re^6: 'do' command is dead? Surely not?

by tobyink (Abbot)
on May 19, 2017 at 15:09 UTC ( #1190639=note: print w/replies, xml ) Need Help??


in reply to Re^5: 'do' command is dead? Surely not?
in thread 'do' command is dead? Surely not?

Because something as seemingly safe as use strict can load strict.pm from the current working directory, which might be somewhere globally writable like "/tmp/".

There was apparently a real-world way of exploiting this to do nasty stuff, but the Perl development team haven't yet publicly disclosed what it is. I imagine it's an exploit in some commonly used Perl web app like cPanel or Webmin. They do plan on releasing the info eventually, once they've decided people have had enough time to move to newer Perl versions which don't have "." in @INC by default.

Replies are listed 'Best First'.
Re^7: 'do' command is dead? Surely not?
by KurtZ (Monk) on May 19, 2017 at 15:53 UTC
    I see, thanks. :)
Re^7: 'do' command is dead? Surely not?
by Anonymous Monk on May 19, 2017 at 17:58 UTC

    That sounds false, cause . was last in @INC for a long time, so strict.pm from /tmp is not a situation that could have happened

      Maybe not strict.pm but some other (optional) module that was not present in the original system could still be loaded from /tmp.

        the program would have to be trying to load said module first ... its expecting it to exist

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1190639]
help
Chatterbox?
[Discipulus]: thanks i was unable to decide where to split the sentece
[marto]: FWIW search.cpan rarely has issues, see http://noc.perl. org for a route to report problems
[oakbox]: thanks, marto.
[marto]: there was a period where search.cpan had some frequent outages for (IIRC) a couple of weeks. I've not had any problems since, until today.
[marto]: this was about 16 months ago maybe. the noc team are, in my experience, very responsive to reports of issues, so please raise the issue after checking known problems/outages

How do I use this? | Other CB clients
Other Users?
Others chanting in the Monastery: (5)
As of 2017-07-26 10:20 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    I came, I saw, I ...
























    Results (389 votes). Check out past polls.