Strawberry Perl Modules Multiple Vulnerabilities (Windows)

  1. Network Vulnerabilities
  2. Denial of Service
  3. Strawberry Perl Modules Multiple Vulnerabilities (Windows)
Summary
The host is installed with Strawberry Perl and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow attackers to cause an affected application to crash or execute arbitrary perl code. Impact Level: System/Application
Solution
Upgrade to Strawberry Perl 5.14.2 or later, Upgrade to Strawberry Perl PAR module version 1.003 or later Upgrade to Strawberry Perl Digest module version 1.17 or later Upgrade to Strawberry Perl Encode module version 2.44 or later Upgrade Strawberry Perl PAR::Packer module version 1.012 or later For updates refer to http://strawberryperl.com ***** NOTE: Ignore this warning if above mentioned versions of modules are already installed. *****
Insight
The flaws are due to - an error in par_mktmpdir function in the 'PAR::Packer' and 'PAR' modules creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. - the 'Digest->new()' function not properly sanitising input before using it in an 'eval()' call, which can be exploited to inject and execute arbitrary perl code. - off-by-one error in the decode_xs function in Unicode/Unicode.xs in the 'Encode' module. - An error within the 'File::Glob::bsd_glob()' function when handling the GLOB_ALTDIRFUNC flag can be exploited to cause an access violation and potentially execute arbitrary code.
Affected
Strawberry Perl PAR module before 1.003 Strawberry Perl Digest module before 1.17 Strawberry Perl Encode module before 2.44 Strawberry Perl PAR::Packer module before 1.012 on winows
References
Updated on 2015-03-25
Severity
High Severity
Classification
Related Vulnerabilities