Bug 928382 (CVE-2015-3406) - VUL-0: CVE-2015-3406,CVE-2015-3407,CVE-2015-3408,CVE-2015-3409: perl-Module-Signature: Module::Signature multiple vulnerabilities
Summary: VUL-0: CVE-2015-3406,CVE-2015-3407,CVE-2015-3408,CVE-2015-3409: perl-Module-S...
Status: RESOLVED FIXED
Alias: CVE-2015-3406
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/116249/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-23 13:16 UTC by Andreas Stieger
Modified: 2016-01-19 11:13 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-04-23 13:16:03 UTC
via oss-sec http://seclists.org/oss-sec/2015/q2/263

> A new version of Module::Signature, was released to fix multiple
> vulnerabilities. Module::Signature is used by most CPAN clients to
> validate PAUSE GPG signature files on the CPAN mirrors and GPG signature
> files inside individual Perl module tarballs.
> 
> The changelog for the 0.75 version is here:
> 
> https://metacpan.org/changes/distribution/Module-Signature
> 
> This commit fixes three flaws:
> 
> https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
> 
> - Module::Signature could be tricked into interpreting the unsigned
> portion of a SIGNATURE file as the signed portion due to faulty parsing
> of the PGP signature boundaries.

CVE-2015-3406

> - When verifying the contents of a CPAN module, Module::Signature
> ignored some files in the extracted tarball that were not listed in the
> signature file. This included some files in the t/ directory that would
> execute automatically during "make test"

CVE-2015-3407

> - When generating checksums from the signed manifest, Module::Signature
> used two argument open() calls to read the files. This allowed embedding
> arbitrary shell commands into the SIGNATURE file that would execute
> during the signature verification process.

CVE-2015-3408

> This commit fixes one more flaw:
> 
> https://github.com/audreyt/module-signature/commit/c41e8885b862b9fce2719449bc9336f0bea658ef
> 
> - Several modules were loaded at runtime inside the extracted module
> directory. Modules like Text::Diff are not guaranteed to be available on
> all platforms and could be added to a malicious module so that they
> would load from the '.' path in @INC.

CVE-2015-3409

openSUSE:13.1 perl-Module-Signature 0.73 affected
openSUSE:13.2 perl-Module-Signature 0.73 affected
openSUSE:Factory perl-Module-Signature 0.78 already fixed.

Package has no dedicated bugowner/maintainer set, adding project maintainers and recent updaters. Any takers?

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3406
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3407
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3408
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3409
Comment 1 Swamp Workflow Management 2015-04-23 22:00:55 UTC
bugbot adjusting priority
Comment 2 Christian Wittmer 2016-01-08 21:47:27 UTC
Maintenace Request created
https://build.opensuse.org/request/show/352653
Comment 3 Andreas Stieger 2016-01-11 10:51:58 UTC
(In reply to Christian Wittmer from comment #2)
> Maintenace Request created
> https://build.opensuse.org/request/show/352653

Thanks, fixed a typo in the CVE and sent https://build.opensuse.org/request/show/353046 to the devel package
Comment 4 Andreas Stieger 2016-01-11 10:52:42 UTC
Update is running. Already fixed in openSUSE Leap 42.1, removed that portion of the update.
Comment 5 Andreas Stieger 2016-01-19 08:05:03 UTC
Releasing update
Comment 6 Swamp Workflow Management 2016-01-19 11:13:28 UTC
openSUSE-SU-2016:0163-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 928382
CVE References: CVE-2015-3406,CVE-2015-3407,CVE-2015-3408,CVE-2015-3409
Sources used:
openSUSE 13.2 (src):    perl-Module-Signature-0.79-4.4.1
openSUSE 13.1 (src):    perl-Module-Signature-0.79-2.4.1