mailing list archives
CVE-2012-5377 through CVE-2012-5383: Windows PATH issues affecting some open-source products
From: cve-assign () mitre org
Date: Thu, 11 Oct 2012 03:28:50 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE-----
MITRE assigned seven CVE names for this recent disclosure that
mentions a few open-source products and also other products, but only
when installed on Windows:
CVE-2012-5382 Zend Server
The essence of the problem is that:
1. Windows has system environment variables, such as PATH, that
apply to all users.
2. On Windows, the installation procedure for a product sometimes
results (through different mechanisms) in a modified PATH that
references the product's installation directory.
3. The permissions of the installation directory might be unsafe.
4. Some other software, including software shipped by Microsoft,
relies on the PATH containing only safe directories.
One example of an open-source product:
says to add C:\php to the PATH, but doesn't suggest checking the
permissions of C:\php before doing this. In this case, the situation
probably should not be described as a vulnerability in the PHP
software. It could perhaps be considered a security-related
One example of another product:
http://docs.activestate.com/activeperl/5.16/install.html has an
installation option related to PATH:
PERL_PATH: If set to 'No', the Perl/bin directory will not be added to
the system PATH environment variable.
and possibly the default is 'Yes' in some or all versions. Here, there
is a better argument that this is a vulnerability in the product,
because (according to the HTB23108 disclosure) the installation
software itself can make an unsafe PATH change.
One possible security guideline is that all products that
automatically modify PATH during installation should be checking all
relevant directory permissions first. This is, however, not the only
possible way to address the underlying problem or problems. It is
currently unclear whether there should be a CVE entry for every
product that handles this PATH issue in any potentially unsafe way.
CVE assignment team, MITRE CVE Numbering Authority
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (SunOS)
-----END PGP SIGNATURE-----
- CVE-2012-5377 through CVE-2012-5383: Windows PATH issues affecting some open-source products cve-assign (Oct 11)