Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Active Perl Modules Multiple Vulnerabilities (Windows)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
The host is installed with Active Perl and is prone to multiple vulnerabilities.
Insight
Insight
The flaws are due to - an error in par_mktmpdir function in the 'PAR::Packer' and 'PAR' modules creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. - the 'Digest->new()' function not properly sanitising input before using it in an 'eval()' call, which can be exploited to inject and execute arbitrary perl code. - off-by-one error in the decode_xs function in Unicode/Unicode.xs in the 'Encode' module. - An error within the 'File::Glob::bsd_glob()' function when handling the GLOB_ALTDIRFUNC flag can be exploited to cause an access violation and potentially execute arbitrary code.
Affected Software
Affected Software
Active Perl PAR module before 1.003 Active Perl Digest module before 1.17 Active Perl Encode module before 2.44 Active Perl PAR::Packer module before 1.012 on winows
Solution
Solution
Upgrade to Perl 5.14.2 or latr, Upgrade to Active Perl PAR module version 1.003 or later Upgrade to Active Perl Digest module version 1.17 or later Upgrade to Active Perl Encode module version 2.44 or later Upgrade Active Perl PAR::Packer module version 1.012 or later ***** NOTE: Ignore this warning if above mentioned versions of modules are already installed. *****
Common Vulnerabilities and Exposures (CVE)
References
- http://secunia.com/advisories/46172
- http://secunia.com/advisories/46279
- http://search.cpan.org/dist/Digest/Digest.pm
- https://bugzilla.redhat.com/show_bug.cgi?id=731246
- https://bugzilla.redhat.com/show_bug.cgi?id=753955
- https://rt.cpan.org/Public/Bug/Display.html?id=69560
- http://www.perl.org/get.html