Описание
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.
The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.
Callers of file-based drivers can read or write files outside of the data directory.
A flaw was found in DBD::File. The complete_table_name method, responsible for building absolute table file paths, does not verify if the file is a symbolic link. This oversight allows a local attacker to create a symbolic link within the data directory that points to an arbitrary file outside of the intended data storage. Consequently, file-based drivers can be tricked into reading from or writing to unauthorized files, potentially leading to information disclosure or data corruption.
Отчет
This Moderate flaw in DBD::File allows a local attacker to achieve arbitrary file read and write access. By creating a symbolic link within the data directory, an attacker can trick file-based drivers into accessing files outside of the intended directories, leading to potential information disclosure or data corruption. This issue is only exploitable by local attackers with write access to the directory used by an application using DBD::File perl module to write or read database data files.
Меры по смягчению последствий
To mitigate this issue, ensure that directories used by applications using DBD::File for data storage have restricted write permissions, preventing untrusted local users from creating symbolic links. This operational control limits an attacker's ability to exploit the vulnerability by preventing the creation of malicious symlinks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | perl-DBI | Fix deferred | ||
| Red Hat Enterprise Linux 6 | perl-DBI | Out of support scope | ||
| Red Hat Enterprise Linux 7 | perl-DBI | Fix deferred | ||
| Red Hat Enterprise Linux 8 | perl-DBI | Fix deferred | ||
| Red Hat Enterprise Linux 8 | perl-DBI:1.641/perl-DBI | Fix deferred | ||
| Red Hat Enterprise Linux 9 | perl-DBI | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.3 Medium
CVSS3
Связанные уязвимости
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
DBD::File versions before 1.651 for Perl do not ensure the table file ...
6.3 Medium
CVSS3