CVE-2003-0618
published 2004-05-04CVE-2003-0618: Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have…
PriorityP47low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
0.36%
29.0th percentile
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | perl | < perl 5.8.3-3 (bookworm) | perl 5.8.3-3 (bookworm) |
| perl | perl | >= 0 < 5.8.3-3 | 5.8.3-3 |
| perl | perl | >= 0 < 5.8.3-3 | 5.8.3-3 |
| perl | perl | >= 0 < 5.8.3-3 | 5.8.3-3 |
| perl | perl | >= 0 < 5.8.3-3 | 5.8.3-3 |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q799-28xv-2qwj: Multiple vulnerabilities in suidperl 5
ghsa_unreviewed·2022-04-29
CVE-2003-0618 [LOW] GHSA-q799-28xv-2qwj: Multiple vulnerabilities in suidperl 5
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
OSV
CVE-2003-0618: Multiple vulnerabilities in suidperl 5
osv·2004-05-04·CVSS 2.1
CVE-2003-0618 [LOW] CVE-2003-0618: Multiple vulnerabilities in suidperl 5
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
Red Hat
leaks file existance information
vendor_redhat·2003-07-30·CVSS 2.1
CVE-2003-0618 [LOW] leaks file existance information
leaks file existance information
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
Statement: The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:
https://access.redhat.com/security/updates/classification/
This issue does not affect Red Hat Enterprise Linux 4.
Debian
CVE-2003-0618: perl - Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obt...
vendor_debian·2003·CVSS 2.1
CVE-2003-0618 [LOW] CVE-2003-0618: perl - Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obt...
Multiple vulnerabilities in suidperl 5.6.1 and earlier allow a local user to obtain sensitive information about files for which the user does not have appropriate permissions.
Scope: local
bookworm: resolved (fixed in 5.8.3-3)
bullseye: resolved (fixed in 5.8.3-3)
forky: resolved (fixed in 5.8.3-3)
sid: resolved (fixed in 5.8.3-3)
trixie: resolved (fixed in 5.8.3-3)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2003-0618 leaks file existance information
bugzilla·2007-07-20·CVSS 2.1
CVE-2003-0618 [LOW] CVE-2003-0618 leaks file existance information
CVE-2003-0618 leaks file existance information
Clone for RHEL3 tracking
+++ This bug was initially created as a clone of Bug #114923 +++
CAN-2003-0618 was reported 2003Jul29 to Debian. You can test for the
existance of files even if you don't have permission to do so by using
the suidperl command.
$ su
# mkdir ~root/delme; chmod 700 ~root/delme;touch ~root/delme/1
# exit
$ suidperl ~root/delme/1
Script is not setuid/setgid in suidperl
$ suidperl ~root/delme/2
Can't open perl script "/root/delme/2": No such file ...
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=220486
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=203426
Affects: 2.1AS 2.1ES 2.1AW 2.1WS (5.6.1)
Affects: 3AS 3ES 3WS (5.8.0)
Debian released an errata for this issue in Feb 2004.
-- Additional comment from mjc@redh
Bugzilla
CVE-2003-0618 leaks file existance information
bugzilla·2004-02-04·CVSS 2.1
CVE-2003-0618 [LOW] CVE-2003-0618 leaks file existance information
CVE-2003-0618 leaks file existance information
CAN-2003-0618 was reported 2003Jul29 to Debian. You can test for the
existance of files even if you don't have permission to do so by using
the suidperl command.
$ su
# mkdir ~root/delme; chmod 700 ~root/delme;touch ~root/delme/1
# exit
$ suidperl ~root/delme/1
Script is not setuid/setgid in suidperl
$ suidperl ~root/delme/2
Can't open perl script "/root/delme/2": No such file ...
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=220486
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=203426
Affects: 2.1AS 2.1ES 2.1AW 2.1WS (5.6.1)
Affects: 3AS 3ES 3WS (5.8.0)
Debian released an errata for this issue in Feb 2004.
Discussion:
Actually this doesn't affect RHEL3 because the setuid perl package was
not shipped.
---
I did some verification
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=203426http://www.debian.org/security/2004/dsa-431http://www.securityfocus.com/bid/9543https://exchange.xforce.ibmcloud.com/vulnerabilities/15012http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=203426http://www.debian.org/security/2004/dsa-431http://www.securityfocus.com/bid/9543https://exchange.xforce.ibmcloud.com/vulnerabilities/15012
2004-05-04
Published