ID de Prueba:	1.3.6.1.4.1.25623.1.0.802562
Categoría:	Denial of Service
Título:	Strawberry Perl Modules Multiple Vulnerabilities - Windows
Resumen:	Strawberry Perl is prone to multiple vulnerabilities.
Descripción:	Summary: Strawberry Perl is prone to multiple vulnerabilities. Vulnerability Insight: The flaws are due to - an error in par_mktmpdir function in the 'PAR::Packer' and 'PAR' modules creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. - the 'Digest->new()' function not properly sanitising input before using it in an 'eval()' call, which can be exploited to inject and execute arbitrary perl code. - off-by-one error in the decode_xs function in Unicode/Unicode.xs in the 'Encode' module. - An error within the 'File::Glob::bsd_glob()' function when handling the GLOB_ALTDIRFUNC flag can be exploited to cause an access violation and potentially execute arbitrary code. Vulnerability Impact: Successful exploitation will allow attackers to cause an affected application to crash or execute arbitrary perl code. Affected Software/OS: Strawberry Perl PAR module before 1.003 Strawberry Perl Digest module before 1.17 Strawberry Perl Encode module before 2.44 Strawberry Perl PAR::Packer module before 1.012 Solution: Update to Strawberry Perl 5.14.2 or later Update to Strawberry Perl PAR module version 1.003 or later Update to Strawberry Perl Digest module version 1.17 or later Update to Strawberry Perl Encode module version 2.44 or later Update Strawberry Perl PAR::Packer module version 1.012 or later CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-5060 XForce ISS Database: par-parmktmpdir-symlink(72435) https://exchange.xforce.ibmcloud.com/vulnerabilities/72435 Common Vulnerability Exposure (CVE) ID: CVE-2011-4114 FEDORA-2011-16856 http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071099.html FEDORA-2011-16859 http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071091.html [oss-security] 20111104 CVE request: unsafe use of /tmp in multiple CPAN modules http://www.openwall.com/lists/oss-security/2011/11/04/2 [oss-security] 20111104 Re: CVE request: unsafe use of /tmp in multiple CPAN modules http://www.openwall.com/lists/oss-security/2011/11/04/4 https://bugzilla.redhat.com/show_bug.cgi?id=753955 https://rt.cpan.org/Public/Bug/Display.html?id=69560 Common Vulnerability Exposure (CVE) ID: CVE-2011-3597 46279 http://secunia.com/advisories/46279 49911 http://www.securityfocus.com/bid/49911 51457 http://secunia.com/advisories/51457 MDVSA-2012:008 http://www.mandriva.com/security/advisories?name=MDVSA-2012:008 MDVSA-2012:009 http://www.mandriva.com/security/advisories?name=MDVSA-2012:009 RHSA-2011:1424 http://www.redhat.com/support/errata/RHSA-2011-1424.html RHSA-2011:1797 http://www.redhat.com/support/errata/RHSA-2011-1797.html USN-1643-1 http://www.ubuntu.com/usn/USN-1643-1 http://aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 https://bugzilla.redhat.com/show_bug.cgi?id=743010 oval:org.mitre.oval:def:19446 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19446 Common Vulnerability Exposure (CVE) ID: CVE-2011-2939 46172 http://secunia.com/advisories/46172 46989 http://secunia.com/advisories/46989 49858 http://www.securityfocus.com/bid/49858 55314 http://secunia.com/advisories/55314 [oss-security] 20110818 CVE request: heap overflow in perl while decoding Unicode string http://www.openwall.com/lists/oss-security/2011/08/18/8 [oss-security] 20110819 Re: CVE request: heap overflow in perl while decoding Unicode string http://www.openwall.com/lists/oss-security/2011/08/19/17 http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5 http://search.cpan.org/~flora/perl-5.14.2/pod/perldelta.pod#Encode_decode_xs_n-byte_heap-overflow_%28CVE-2011-2939%29 https://bugzilla.redhat.com/show_bug.cgi?id=731246 Common Vulnerability Exposure (CVE) ID: CVE-2011-2728 FEDORA-2011-15484 http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069752.html http://perl5.git.perl.org/perl.git/commit/1af4051e077438976a4c12a0622feaf6715bec77 https://blogs.oracle.com/sunsecurity/entry/cve_2011_2728_denial_of1 https://bugzilla.redhat.com/show_bug.cgi?id=742987
Copyright	Copyright (C) 2012 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.