For those systems, Perl versions 4 and 5 attempt to work around this vulnerability with a special program named suidperl, also known as sperl. There is a buffer overflow condition in suidperl built from Perl 4.n and Perl 5.n distributions earlier than version 5.004. If this program is called with appropriately crafted parameters, an attacker can execute arbitrary commands as root. This vulnerability is being actively exploited. Impact Users executing Perl scripts with the setuid bit set can execute arbitrary commands with the effective uid of the owner of the Perl script.
Attackers can execute commands as root.
If you find that your system is vulnerable, replace the suidperl and sperl programs with new versions. Section B describes how to do that if your site uses versions of suidperl and sperl that are provided as part of a vendor-supplied distribution. Sites that installed suidperl and sperl programs themselves from the Perl source distribution should patch the distribution as described in Section C or upgrade to version 5.004 as described in Section D. Note that Perl4 is no longer supported. A. Determine if your system is vulnerable and disable vulnerable programs To determine if a system is vulnerable to this problem and to disable the programs that are believed to be vulnerable, use the following find command or a variant. Consult your local system documentation to determine how to tailor the find program on your system.