Paul Szabo has reported a vulnerability in Perl "File::Path::rmtree", which potentially can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a race condition in the way "File::Path::rmtree" handles directory permissions when cleaning up directories. This can be exploited by replacing an existing sub directory in the directory tree with a symbolic link to an arbitrary file.

Successful exploitation may allow changing permissions of arbitrary files, if root uses an application using the vulnerable code to delete files in a directory having a world-writable sub directory.

This is related to:
SA13643

Solution
Do not use applications, which use "File::Path::rmtree", on systems with untrusted users.

Provided and/or discovered by
Paul Szabo

Original Advisory
http://www.ubuntulinux.org/support/documentation/usn/usn-94-1

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers