Skip to content

Commit fb5f378

Browse files
committedDec 5, 2018
(perl #133706) remove exploit code from Storable
Storable packaged the metasploit framework code for CVE-2015-1592, which triggered virus scanners. To prevent that remove the packaged exploit code and test for the underlying structure we trigger the warning on.
1 parent f9fd003 commit fb5f378

File tree

3 files changed

+12
-275
lines changed

3 files changed

+12
-275
lines changed
 

‎MANIFEST

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3662,7 +3662,6 @@ dist/Storable/t/code.t See if Storable works
36623662
dist/Storable/t/compat01.t See if Storable works
36633663
dist/Storable/t/compat06.t See if Storable works
36643664
dist/Storable/t/croak.t See if Storable works
3665-
dist/Storable/t/CVE-2015-1592.inc See if Storable works
36663665
dist/Storable/t/CVE-2015-1592.t See if Storable works
36673666
dist/Storable/t/dclone.t See if Storable works
36683667
dist/Storable/t/destroy.t Test Storable in global destructon

‎dist/Storable/t/CVE-2015-1592.inc

Lines changed: 0 additions & 261 deletions
This file was deleted.

‎dist/Storable/t/CVE-2015-1592.t

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,21 @@
11
#!/usr/bin/perl
22

33
use strict;
4+
use warnings;
45
use Test::More;
6+
use Storable qw(freeze thaw);
57
plan tests => 1;
68

7-
use File::Temp qw(tempdir);
8-
use File::Spec;
9-
my $tmp_dir = tempdir(CLEANUP => 1);
10-
my $tmp_file = File::Spec->catfile($tmp_dir, 'sploit');
9+
# this original worked with the packaged exploit, but that
10+
# triggers virus scanners, so test for the behaviour instead
11+
my $x = bless \(my $y = "mt-config.cgi"), "CGITempFile";
12+
13+
my $frozen = freeze($x);
1114

12-
my $file = __FILE__;
13-
$file =~ s/\.t$/.inc/;
14-
my $inc = $ENV{PERL_CORE} ? "-Ilib -I../../lib" : "-I".join(" -I", @INC);
15-
system qq($^X $inc -w "$file" 2>$tmp_file);
16-
open(my $fh, "<", $tmp_file) or die "$tmp_file $!";
1715
{
18-
local $/;
19-
my $err = <$fh>;
20-
like($err, qr/SECURITY: Movable-Type CVE-2015-1592 Storable metasploit attack/,
21-
'Detect CVE-2015-1592');
16+
my $warnings = '';
17+
local $SIG{__WARN__} = sub { $warnings .= "@_" };
18+
thaw($frozen);
19+
like($warnings, qr/SECURITY: Movable-Type CVE-2015-1592 Storable metasploit attack/,
20+
'Detect CVE-2015-1592');
2221
}

0 commit comments

Comments
 (0)
Please sign in to comment.