RE: perl freezed data across network

Not unless there's a bug in Perl (which is possible).  Storable currently does not allow for serialized code, though in the future, who knows?

You could still change the behavior of an application, however.  If you serialize an object, it's still a reference blessed into a package.  You could change the package the reference is blessed into to get the target application to execute an incorrect method, for example, but the other module would have to be loaded in advance.  A tricky thing to exploit.

Changing data could have other unforeseen issues and the level of risk probably depends on the application and how it's used.

Either way, though, consider Storable's "freeze" to be completely unsecured; if you are sending sensitive data or need to guarantee integrity, you should probably make use of transport protocols (like SSL or TLS) that offer an appropriate level of protection.

David

-----Original Message-----
From: George Nistorica [mailto:[email protected]] 
Sent: Friday, June 04, 2004 2:20 AM
To: [email protected]
Subject: perl freezed data across network

I wonder if i freeze a tree of data using Storable, and send it across
network to a daemon to unfreeze, could a malicious client send it some
sort of freezed data that could make the daemon run arbitrary code?
the daemon is written in perl