Input validation error in Perl - CVE-2011-3597
Published: January 13, 2012 / Updated: July 29, 2020
Vulnerability identifier: #VU32828
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-3597
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Affected software
Perl
Amazon Linux AMI
Gentoo Linux
perl (Alpine package)
Amazon Linux AMI
Gentoo Linux
perl (Alpine package)
How to mitigate CVE-2011-3597
Install update from vendor's website.
perl (Alpine package) - update to 5.12.4-r0
Links to Public Exploits and PoC-codes
External References
- http://aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc
- http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://secunia.com/advisories/46279
- http://secunia.com/advisories/51457
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:008
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:009
- http://www.redhat.com/support/errata/RHSA-2011-1424.html
- http://www.redhat.com/support/errata/RHSA-2011-1797.html
- http://www.securityfocus.com/bid/49911
- http://www.ubuntu.com/usn/USN-1643-1
- https://bugzilla.redhat.com/show_bug.cgi?id=743010
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19446