CVE-2014-10401

Vulnerability

An issue was discovered in the DBI module for Perl before version 1.632. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute. This vulnerability is documented in commit caedc0d7d602f5b2ae5efc1b00f39efeafb7b05a [1]. Affected versions include all DBI releases prior to 1.632.

Exploitation

An attacker can exploit this by connecting to a database using a DBD::File driver (such as DBD::CSV) with a crafted f_dir attribute pointing to a non-existent directory or by leveraging existing configurations where f_dir is not properly validated. The attacker does not need authentication but must be able to control the connection parameters or influence the f_dir value. The fix adds a check that the specified directory exists before allowing the connection, preventing access to unintended directories.

Impact

Successful exploitation allows an attacker to read arbitrary files from the filesystem, leading to disclosure of sensitive information. This is classified as an information disclosure vulnerability (CIA impact: confidentiality). The Ubuntu security notice [2] states that an attacker could possibly use this issue to expose sensitive information.

Mitigation

The vulnerability is fixed in DBI version 1.632, released on 9th November 2014 [1]. Users should upgrade to DBI 1.632 or later. Ubuntu issued security updates (USN-4509-1) [2] to address this issue. There is no known workaround; upgrading is the recommended mitigation.