CVE-2005-0156

Perl 5.8.0 - Local Buffer Overflow via PERLIO_DEBUG Environment Variable

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2005-0156. PoCs published by Kevin Finisterre.

AI-analyzed exploit summary This exploit targets a buffer overflow in Perl's `PerlIO_Debug()` function in setuid Perl scripts, leveraging a crafted `PERLIO_DEBUG` environment variable and directory traversal to trigger arbitrary code execution. The shellcode executes `/bin/sh` with elevated privileges.

Description

Buffer overflow in the PerlIO implementation in Perl 5.8.0, when installed with setuid support (sperl), allows local users to execute arbitrary code by setting the PERLIO_DEBUG variable and executing a Perl script whose full pathname contains a long directory tree.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Kevin Finisterre · clocallinux

https://www.exploit-db.com/exploits/791

View Code ZIP pw:eip

This exploit targets a buffer overflow in Perl's `PerlIO_Debug()` function in setuid Perl scripts, leveraging a crafted `PERLIO_DEBUG` environment variable and directory traversal to trigger arbitrary code execution. The shellcode executes `/bin/sh` with elevated privileges.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Reliable

Target: Perl 5.8.4 (specifically perl-suid on Debian 3.1)

No auth needed

Prerequisites: Presence of a setuid Perl script · Write access to `/tmp` · Perl 5.8.4 with vulnerable `PerlIO_Debug()`

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (15)

Core 15

Core References

Vendor Advisory vendor-advisory x_refsource_conectiva

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=001056

Mailing List mailing-list x_refsource_fulldisc

http://marc.info/?l=full-disclosure&m=110779721503111&w=2

Various Sources x_refsource_misc

http://www.digitalmunition.com/DMA%5B2005-0131b%5D.txt

Patch, Vendor Advisory vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/12426

Patch, Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2005-105.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/14120

Patch, Vendor Advisory vendor-advisory x_refsource_trustix

http://www.trustix.org/errata/2005/0003/

Patch, Vendor Advisory vendor-advisory x_refsource_redhat

http://www.redhat.com/support/errata/RHSA-2005-103.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10803

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/55314

Mailing List mailing-list x_refsource_bugtraq

http://marc.info/?l=bugtraq&m=110737149402683&w=2

Mailing List vendor-advisory x_refsource_fedora

http://fedoranews.org/updates/FEDORA--.shtml

Vendor Advisory vendor-advisory x_refsource_mandrake

http://www.mandriva.com/security/advisories?name=MDKSA-2005:031

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/19208

Exploit, Vendor Advisory vendor-advisory x_refsource_gentoo

http://www.gentoo.org/security/en/glsa/glsa-200502-13.xml

Scores

EPSS 0.0132

EPSS Percentile 67.0%

Details

Status published

Products (27)

ibm/aix 5.2

ibm/aix 5.3

larry_wall/perl 5.8.0

larry_wall/perl 5.8.1

larry_wall/perl 5.8.3

larry_wall/perl 5.8.4

larry_wall/perl 5.8.4.1

larry_wall/perl 5.8.4.2

larry_wall/perl 5.8.4.2.3

larry_wall/perl 5.8.4.3

... and 17 more

Published Feb 07, 2005

Tracked Since Feb 18, 2026