Active Perl Modules Multiple Vulnerabilities (Windows)

  1. Network Vulnerabilities
  2. Denial of Service
  3. Active Perl Modules Multiple Vulnerabilities (Windows)
Summary
The host is installed with Active Perl and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow attackers to cause an affected application to crash or execute arbitrary perl code. Impact Level: System/Application
Solution
Upgrade to Perl 5.14.2 or latr, Upgrade to Active Perl PAR module version 1.003 or later Upgrade to Active Perl Digest module version 1.17 or later Upgrade to Active Perl Encode module version 2.44 or later Upgrade Active Perl PAR::Packer module version 1.012 or later For updates refer to http://www.perl.org/get.html ***** NOTE: Ignore this warning if above mentioned versions of modules are already installed. *****
Insight
The flaws are due to - an error in par_mktmpdir function in the 'PAR::Packer' and 'PAR' modules creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. - the 'Digest->new()' function not properly sanitising input before using it in an 'eval()' call, which can be exploited to inject and execute arbitrary perl code. - off-by-one error in the decode_xs function in Unicode/Unicode.xs in the 'Encode' module. - An error within the 'File::Glob::bsd_glob()' function when handling the GLOB_ALTDIRFUNC flag can be exploited to cause an access violation and potentially execute arbitrary code.
Affected
Active Perl PAR module before 1.003 Active Perl Digest module before 1.17 Active Perl Encode module before 2.44 Active Perl PAR::Packer module before 1.012 on winows
References
Updated on 2015-03-25
Severity
High Severity
Classification
Related Vulnerabilities