[VulnWatch] Perl Safe.pm compartment reuse vuln

From: Rain Forest Puppy (rfp@vulnwatch.org)
Date: 11/06/02


Date: Wed, 6 Nov 2002 05:59:18 +0000 (GMT)
From: Rain Forest Puppy <rfp@vulnwatch.org>
To: <vulnwatch@vulnwatch.org>


A bug was found in Perl's Safe.pm module:

http://use.perl.org/articles/02/10/06/1118222.shtml?tid=5

Basically, code in the sandbox can modify the execution/operation mask via
@_; if the compartment was ever reused, the second time around it might
use the modified execution mask.

Perl <= 5.8.0 are vuln.

- rfp