The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. NOTE: some of these details are obtained from third party information. NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.

• http://www.openwall.com/lists/oss-security/2012/05/02/6
• http://www.osvdb.org/81671
• http://secunia.com/advisories/48990
• https://bitbucket.org/shlomif/perl-config-inifiles/changeset/a08fa26f4f59
• https://bugzilla.redhat.com/show_bug.cgi?id=818386
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080713.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080716.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081207.html
• http://www.securityfocus.com/bid/53361
• http://www.ubuntu.com/usn/USN-1543-1
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75328

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. The helper is the open path behind the documented -file argument: new(-file => $thing) reaches it through ReadConfig. An in-memory scalar reference (-file => \$text) does not open a path and is unaffected. Any caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.

• https://github.com/shlomif/perl-Config-IniFiles/commit/3e48f9627fbba4dae5de35be1f735cdeb7e47fb8.patch
• https://metacpan.org/release/SHLOMIF/Config-IniFiles-3.001000/changes