Zero-friction vulnerability management platform

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Strawberry Perl Modules Multiple Vulnerabilities (Windows)

Information

Severity

Severity

High

Family

Family

Denial of Service

CVSSv2 Base

CVSSv2 Base

7.5

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Solution Type

Solution Type

Vendor Patch

Created

Created

10 years ago

Modified

Modified

4 years ago

Summary

The host is installed with Strawberry Perl and is prone to multiple vulnerabilities.

Insight

Insight

The flaws are due to - an error in par_mktmpdir function in the 'PAR::Packer' and 'PAR' modules creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. - the 'Digest->new()' function not properly sanitising input before using it in an 'eval()' call, which can be exploited to inject and execute arbitrary perl code. - off-by-one error in the decode_xs function in Unicode/Unicode.xs in the 'Encode' module. - An error within the 'File::Glob::bsd_glob()' function when handling the GLOB_ALTDIRFUNC flag can be exploited to cause an access violation and potentially execute arbitrary code.

Affected Software

Affected Software

Strawberry Perl PAR module before 1.003 Strawberry Perl Digest module before 1.17 Strawberry Perl Encode module before 2.44 Strawberry Perl PAR::Packer module before 1.012 on winows

Solution

Solution

Upgrade to Strawberry Perl 5.14.2 or later, Upgrade to Strawberry Perl PAR module version 1.003 or later Upgrade to Strawberry Perl Digest module version 1.17 or later Upgrade to Strawberry Perl Encode module version 2.44 or later Upgrade Strawberry Perl PAR::Packer module version 1.012 or later ***** NOTE: Ignore this warning if above mentioned versions of modules are already installed. *****

Common Vulnerabilities and Exposures (CVE)