Debian: DSA-3261-2: libmodule-signature-perl regression update

    Date20 May 2015
    CategoryDebian
    75
    Posted ByLinuxSecurity Advisories
    The update for libmodule-signature-perl issued as DSA-3261-1 introduced a regression in the handling of the --skip option of cpansign. Updated packages are now available to address this regression. For reference, the original advisory text follows.
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3261-2                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                      Salvatore Bonaccorso
    May 20, 2015                           http://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : libmodule-signature-perl
    Debian Bug     : 785701
    
    The update for libmodule-signature-perl issued as DSA-3261-1 introduced
    a regression in the handling of the --skip option of cpansign. Updated
    packages are now available to address this regression. For reference,
    the original advisory text follows.
    
    Multiple vulnerabilities were discovered in libmodule-signature-perl, a
    Perl module to manipulate CPAN SIGNATURE files. The Common
    Vulnerabilities and Exposures project identifies the following problems:
    
    CVE-2015-3406
    
        John Lightsey discovered that Module::Signature could parses the
        unsigned portion of the SIGNATURE file as the signed portion due to
        incorrect handling of PGP signature boundaries.
    
    CVE-2015-3407
    
        John Lightsey discovered that Module::Signature incorrectly handles
        files that are not listed in the SIGNATURE file. This includes some
        files in the t/ directory that would execute when tests are run.
    
    CVE-2015-3408
    
        John Lightsey discovered that Module::Signature uses two argument
        open() calls to read the files when generating checksums from the
        signed manifest. This allows to embed arbitrary shell commands into
        the SIGNATURE file that would execute during the signature
        verification process.
    
    CVE-2015-3409
    
        John Lightsey discovered that Module::Signature incorrectly handles
        module loading, allowing to load modules from relative paths in
        @INC. A remote attacker providing a malicious module could use this
        issue to execute arbitrary code during signature verification.
    
    For the oldstable distribution (wheezy), this problem has been fixed in
    version 0.68-1+deb7u3.
    
    For the stable distribution (jessie), this problem has been fixed in
    version 0.73-1+deb8u2.
    
    For the unstable distribution (sid), this problem has been fixed in
    version 0.79-1.
    
    We recommend that you upgrade your libmodule-signature-perl packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.