#VU273 Insecure search path in perl5-porters in OpenBSD - CVE-2016-1238

Vulnerability identifier: #VU273

Vulnerability risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1238

CWE-ID: CWE-427

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
OpenBSD
Operating systems & Components / Operating system

Vendor: OpenBSD

Description

The vulnerability allows a local user to potentially elevate privileges.

The vulnerability exists due to Perl 5 module loads modules from the includes directory array ("@INC") in which the last element is the current directory ("."). A local attacker can place specially crafted modules into world-writable directory and trick the victim to run arbitrary script from this directory.

Successful exploitation of this vulnerability may allow a local attacker to obtain elevated privileges on the system.

Mitigation
Apply the following patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/027_perl.patch.sig
http://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/024_perl.patch.sig

Vulnerable software versions

OpenBSD: 5.8 - 5.9

---

External links
https://www.openbsd.org/errata58.html
https://www.openbsd.org/errata59.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.