Stay Secure with the Latest Linux Advisories

security advisorygentooarbitrary code execution

Gentoo Linux: GLSA 201403-08 Normal: PlRPC Code Execution Risk

PlRPC uses Storable which allows for code execution prior to Authentication. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201403-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PlRPC: Arbitrary code execution Date: March 27, 2014 Bugs: #497692 ID: 201403-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= PlRPC uses Storable which allows for code execution prior to Authentication Background ========= The Perl RPC Module is a Perl module that implements IDL-free RPCs. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-perl/PlRPC < 0.202.0-r2 > = 0.202.0-r2 Description ========== PlRPC uses Storable module for serialization and deserialization of untrusted data. Deserialized data can contain objects which can lead to loading of foreign modules, and possible execution of arbitrary code. Impact ===== A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition. Workaround ========= External authentication mechanism can be used with PlRPC such as TLS or IPSEC. Resolution ========= All PlRPC users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-perl/PlRPC-0.202.0-r2" References ========= [ 1 ] CVE-2013-7284 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-7284 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201403-08 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ -- Mikle Kolyada Gentoo Linux Developer . Gentoo GLSA 202310-12 highlights vulnerabilities in PlRPC that could lead to code execution without prior authentication. Immediate update is advised.. PlRPC, Arbitrary Code Execution, Gentoo Security. . LinuxSecurity.com Team

Mar 27, 2014 Gentoo