Executive brief
A security vulnerability exists in the suidperl component of the Perl programming language, which is used to run scripts with elevated administrative privileges. A local user can exploit this flaw to bypass security restrictions and gain full control over the affected system. This could lead to unauthorized access to sensitive data, system-wide outages, or the installation of malicious software.
Technical details
A buffer overflow vulnerability exists in suidperl (also known as sperl), a utility in Perl 4.x and 5.x designed to allow Perl scripts to run with setuid privileges. The flaw is triggered when the utility handles specially crafted input or environment variables, leading to memory corruption. Because suidperl typically runs with root permissions to facilitate setuid operations, a local, unprivileged attacker can exploit this overflow to execute arbitrary code with elevated (root) privileges. This is a classic local privilege escalation vulnerability resulting from improper bounds checking in a setuid binary.
Affected products
- Perl Foundation Perl 4.x, 5.x
Timeline
- 1997-05-29: disclosed: NVD Published Date