Summary
The remote host is missing an update to perl
announced via advisory DSA 2267-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202267-1
Insight
It was discovered that Perl's Safe module - a module to compile and execute code in restricted compartments - could by bypassed.
Please note that this update is known to break Petal, an XML-based templating engine (shipped with Debian 6.0/Squeeze in the package libpetal-perl, see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=582805 for details). A fix is not yet available. If you use Petal, you might consider to put the previous Perl packages on hold.
For the oldstable distribution (lenny), this problem has been fixed in version 5.10.0-19lenny5.
For the stable distribution (squeeze), this problem has been fixed in version 5.10.1-17squeeze2.
For the unstable distribution (sid), this problem has been fixed in version 5.12.3-1.
We recommend that you upgrade your perl packages.
Severity
Classification
-
CVE CVE-2010-1447 -
CVSS Base Score: 8.5
AV:N/AC:M/Au:S/C:C/I:C/A:C
Related Vulnerabilities