Input validation error in ActiveState ActivePerl

1) Input validation error

EUVDB-ID: #VU43401

Risk: Low

CVSSv4.0: 6.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2012-5377

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a local #AU# to execute arbitrary code.

Untrusted search path vulnerability in the installation functionality in ActivePerl 5.16.1.1601, when installed in the top-level C: directory, allows local users to gain privileges via a Trojan horse DLL in the C:PerlSitein directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426 Untrusted Search Path'

Mitigation

Install update from vendor's website.

Vulnerable software versions

ActivePerl: 5.16.1.1601

CPE2.3

• cpe:2.3:a:activestate_corporation:activeperl:5.16.1.1601:*:*:*:*:*:*:*

External links

https://osvdb.org/86177
https://www.htbridge.com/advisory/HTB23108

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.