Beefy Boxes and Bandwidth Generously Provided by pair Networks
P is for Practical

Re^5: 'do' command is dead? Surely not?

by KurtZ (Friar)
on May 19, 2017 at 14:53 UTC ( #1190635=note: print w/replies, xml ) Need Help??

in reply to Re^4: 'do' command is dead? Surely not?
in thread 'do' command is dead? Surely not?

Recent versions of Perl (v5.24.1+) removed '.' from @INC,

Ehm , why?

  • Comment on Re^5: 'do' command is dead? Surely not?

Replies are listed 'Best First'.
Re^6: 'do' command is dead? Surely not?
by tobyink (Canon) on May 19, 2017 at 15:09 UTC

    Because something as seemingly safe as use strict can load from the current working directory, which might be somewhere globally writable like "/tmp/".

    There was apparently a real-world way of exploiting this to do nasty stuff, but the Perl development team haven't yet publicly disclosed what it is. I imagine it's an exploit in some commonly used Perl web app like cPanel or Webmin. They do plan on releasing the info eventually, once they've decided people have had enough time to move to newer Perl versions which don't have "." in @INC by default.

      I see, thanks. :)

      That sounds false, cause . was last in @INC for a long time, so from /tmp is not a situation that could have happened

        Maybe not but some other (optional) module that was not present in the original system could still be loaded from /tmp.

Re^6: 'do' command is dead? Surely not?
by dasgar (Priest) on May 19, 2017 at 18:24 UTC

    Here's one blog post that describes some background of the situation. Here's a blog post from Brian D. Foy talking about '.' being removed from @INC in 5.26.

    Also, it's documented in the perldelta for 5.24.1.

    And there's also a CVE for this issue too (CVE-2016-1238).

      Great thanks!

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1190635]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others making s'mores by the fire in the courtyard of the Monastery: (9)
As of 2019-10-17 18:23 GMT
Find Nodes?
    Voting Booth?