Advisories:rPSA-2007-0232

From rPath Wiki

rPath Security Advisory 2007-0232-1

Published: 2007-11-06

Products

• rPath Linux 1

Rating

Minor

Exposure Level Classification

Local Deterministic Weakness

Updated Versions

• perl=conary.rpath.com@rpl:1/5.8.7-8.2-1

rPath Issue Tracking System

• RPL-1813

References

• CVE-2007-5116

Description

Previous versions of the perl package contain weaknesses when evaluating

regular expressions.

If a system is serving a perl-based web application that evaluates

remote input as a regular expression, an attacker may be be able to

exploit these weaknesses to execute arbitrary, attacker-provided code on

the system, potentially elevating this to a remote, deterministic

unauthorized access vulnerability.

In its default configuration, rPath Linux 1 does not enable any

perl-based web applications and is thus not vulnerable to this potential

unauthorized access.

Copyright 2007 rPath, Inc. This file is distributed under the terms of the MIT License. A copy is available at http://www.rpath.com/permanent/mit-license.html