CVE-2015-3406

What it actually does

The vulnerability allows an attacker to supply a crafted SIGNATURE file such that the PGP signature verification logic treats an unsigned region as the signed content, bypassing integrity checks on Perl module distributions.

Why it matters to the business

Organizations relying on unsigned or tampered Perl modules from CPAN or mirrors may unknowingly install malicious code, leading to supply-chain compromise of build and deployment pipelines; the issue has been public for years with negligible observed exploitation.

How an attack unfolds

An attacker prepares a SIGNATURE file containing both signed and unsigned sections, manipulates the PGP parsing so the unsigned malicious portion is accepted as verified, then hosts the altered archive on a mirror or repository that developers fetch during module installation.

How to fix it

Upgrade Module::Signature to version 0.74 or later on all systems; replace any locally cached or mirrored distributions that were validated with the vulnerable parser; consider pinning the module in CPANfile or similar dependency manifests.

How to confirm the fix worked

Run 'cpan -D Module::Signature' or inspect the installed version in the Perl site library; attempt to verify a test SIGNATURE containing unsigned trailing data to confirm the parser now rejects it; review CPAN mirror logs for any distributions fetched before the update.

Typical attack path

1. Identify a Perl project that uses Module::Signature for distribution verification.
2. Craft a SIGNATURE file that places attacker-controlled content outside the signed region but causes the parser to treat it as signed.
3. Upload or mirror the malicious archive to a location reachable by target developers or CI systems.
4. Wait for or entice victims to run cpan, cpanm, or similar tooling that fetches and verifies the module.
5. Gain execution of attacker code inside the victim's build or runtime environment.

How to detect it

Search Perl module installation logs, cpanm build directories, and proxy logs for SIGNATURE files fetched from untrusted mirrors; look for archives where the signed portion length does not match the actual PGP signature block; examine any post-install scripts or .pm files that appeared after a signature verification event.

What your security team should do

• Immediately inventory all Perl environments and CI pipelines that depend on Module::Signature and schedule the upgrade to 0.74+.
• Add a dependency policy check that blocks installs of Module::Signature versions older than 0.74.
• Monitor CPAN and internal mirrors for any distributions whose signatures were processed with the vulnerable parser.
• Review historical build logs for unexpected module installs that occurred after the vulnerability became public.