Test ID:	1.3.6.1.4.1.25623.1.0.69971
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2265-1)
Summary:	The remote host is missing an update for the Debian 'perl' package(s) announced via the DSA-2265-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'perl' package(s) announced via the DSA-2265-1 advisory. Vulnerability Insight: Mark Martinec discovered that Perl incorrectly clears the tainted flag on values returned by case conversion functions such as lc. This may expose preexisting vulnerabilities in applications which use these functions while processing untrusted input. No such applications are known at this stage. Such applications will cease to work when this security update is applied because taint checks are designed to prevent such unsafe use of untrusted input data. For the oldstable distribution (lenny), this problem has been fixed in version 5.10.0-19lenny4. For the stable distribution (squeeze), this problem has been fixed in version 5.10.1-17squeeze1. For the testing distribution (wheezy) and the unstable distribution (sid), this problem has been fixed in version 5.10.1-20. We recommend that you upgrade your perl packages. Affected Software/OS: 'perl' package(s) on Debian 5, Debian 6. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1487 43921 http://secunia.com/advisories/43921 44168 http://secunia.com/advisories/44168 47124 http://www.securityfocus.com/bid/47124 DSA-2265 http://www.debian.org/security/2011/dsa-2265 FEDORA-2011-4610 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057891.html FEDORA-2011-4631 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057971.html MDVSA-2011:091 http://www.mandriva.com/security/advisories?name=MDVSA-2011:091 SUSE-SR:2011:009 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html [oss-security] 20110401 CVE Request -- perl -- lc(), uc() routines are laundering tainted data http://openwall.com/lists/oss-security/2011/04/01/3 [oss-security] 20110404 Re: CVE Request -- perl -- lc(), uc() routines are laundering tainted data http://openwall.com/lists/oss-security/2011/04/04/35 http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99 http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336 https://bugzilla.redhat.com/show_bug.cgi?id=692844 https://bugzilla.redhat.com/show_bug.cgi?id=692898 perl-laundering-security-bypass(66528) https://exchange.xforce.ibmcloud.com/vulnerabilities/66528
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.