Permissions, Privileges, and Access Controls in Perl - CVE-2011-1487
Published: April 11, 2011 / Updated: August 11, 2020
Vulnerability identifier: #VU45133
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
CVE-ID: CVE-2011-1487
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Perl
Affected software:
Perl
Perl
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
How to mitigate CVE-2011-1487
Install update from vendor's website.
Sources
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057891.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057971.html
- http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
- http://openwall.com/lists/oss-security/2011/04/01/3
- http://openwall.com/lists/oss-security/2011/04/04/35
- http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99
- http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336
- http://secunia.com/advisories/43921
- http://secunia.com/advisories/44168
- http://www.debian.org/security/2011/dsa-2265
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:091
- http://www.securityfocus.com/bid/47124
- https://bugzilla.redhat.com/show_bug.cgi?id=692844
- https://bugzilla.redhat.com/show_bug.cgi?id=692898
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66528