Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2007:0966 :

Updated Perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl. (CVE-2007-5116)

Users of Perl are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing this issue.

A buffer overflow vulnerability exists in the 'perl.rte' fileset. A remote attacker may execute arbitrary code if a Perl script executing on the system is listening on a network port. If exploited the attacker can execute arbitrary code with the same privileges as the script.

For more details please visit :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl. (CVE-2007-5116)

Specially crafted regular expressions could lead to a buffer overflow in perl's regular expressions engine. Scripts processing data from untrusted sources could therefore potentially be exploited by attackers to execute arbitrary code.

Depending on the purpose of the scripts, the vulnerability can be exploited remotely or locally.

The vulnerability has been tracked by CVE-2007-5116.

I   Service Console package security updates

  a. OpenPegasus PAM Authentication Buffer Overflow

  Alexander Sotirov from VMware Security Research discovered a   buffer overflow vulnerability in the OpenPegasus Management server.
  This flaw could be exploited by a malicious remote user on the   service console network to gain root access to the service console.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2007-5360 to this issue.

  b.   Updated Samba package

       An issue where attackers on the service console management        network can cause a stack-based buffer overflow in the        reply_netbios_packet function of nmbd in Samba. On systems        where Samba is being used as a WINS server, exploiting this        vulnerability can allow remote attackers to execute arbitrary        code via crafted WINS Name Registration requests followed by a        WINS Name Query request.

       An issue where attackers on the service console management        network can exploit a vulnerability that occurs when Samba is        configured as a Primary or Backup Domain controller. The        vulnerability allows remote attackers to have an unknown impact        via crafted GETDC mailslot requests, related to handling of        GETDC logon server requests.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the names CVE-2007-5398 and CVE-2007-4572 to these        issues.

 Note: By default Samba is not configured as a WINS server or a domain        controller and ESX is not vulnerable unless the administrator        has changed the default configuration.

       This vulnerability can be exploited remotely only if the        attacker has access to the service console network.

       Security best practices provided by VMware recommend that the        service console be isolated from the VM network. Please see        http://www.vmware.com/resources/techresources/726 for more        information on VMware security best practices.

  c.   Updated util-linux package

       The patch addresses an issue where the mount and umount        utilities in util-linux call the setuid and setgid functions in        the wrong order and do not check the return values, which could        allow attackers to gain elevated privileges via helper        application such as mount.nfs.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the name CVE-2007-5191 to this issue.

  d.   Updated Perl package

       The update addresses an issue where the regular expression        engine in Perl can be used to issue a specially crafted regular        expression that allows the attacker to run arbitrary code with        the permissions level of the current Perl user.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the name CVE-2007-5116 to this issue.

  e.   Updated OpenSSL package

       A flaw in the SSL_get_shared_ciphers() function could allow an        attacker to cause a buffer overflow problem by sending ciphers        to applications that use the function.

       The Common Vulnerabilities and Exposures project (cve.mitre.org)        has assigned the names CVE-2007-3108, and CVE-2007-5135 to these        issues.

Updated Perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl. (CVE-2007-5116)

Users of Perl are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing this issue.

The remote host is missing AIX PTF U815030, which is related to the security of the package perl.rte.

The remote host is missing AIX PTF U814193, which is related to the security of the package perl.rte.

A buffer overflow vulnerability exists in the 'perl.rte' fileset. A remote attacker may execute arbitrary code if a Perl script executing on the system is listening on a network port. If exploited the attacker can execute arbitrary code with the same privileges as the script.

For more details please visit :

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

This update fixes a buffer overflow in perl's regex engine.
(CVE-2007-5116)

It was discovered that Perl's regular expression library did not correctly handle certain UTF sequences. If a user or automated system were tricked into running a specially crafted regular expression, a remote attacker could crash the application or possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-28 (Perl: Buffer overflow)

    Tavis Ormandy and Will Drewry (Google Security Team) discovered a     heap-based buffer overflow in the Regular Expression engine (regcomp.c)     that occurs when switching from byte to Unicode (UTF-8) characters in a     regular expression.
  Impact :

    A remote attacker could either entice a user to compile a specially     crafted regular expression or actively compile it in case the script     accepts remote input of regular expressions, possibly leading to the     execution of arbitrary code with the privileges of the user running     Perl.
  Workaround :

    There is no known workaround at this time.

Resolves CVE-2007-5116: perl regular expression UTF parsing errors

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Resolves: CVE-2007-5116: perl regular expression UTF parsing errors

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Red Hat reports :

A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl.

Will Drewry and Tavis Ormandy of the Google Security Team have discovered a UTF-8 related heap overflow in Perl's regular expression compiler, probably allowing attackers to execute arbitrary code by compiling specially crafted regular expressions.

Tavis Ormandy and Will Drewry discovered a flaw in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, resulting in the possible execution of arbitrary code with the permissions of the user running Perl.

Updated packages have been patched to prevent these issues.

ID	Name	Product	Family	Severity
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
67586	Oracle Linux 3 / 4 / 5 : perl (ELSA-2007-0966)	Nessus	Oracle Linux Local Security Checks	high
64309	AIX 5.3 TL 5 : perl (IZ10244)	Nessus	AIX Local Security Checks	high
60283	Scientific Linux Security Update : perl on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60282	Scientific Linux Security Update : perl on SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41165	SuSE9 Security Update : perl (YOU Patch Number 11964)	Nessus	SuSE Local Security Checks	high
40372	VMSA-2008-0001 : Moderate OpenPegasus PAM Authentication Buffer Overflow and updated service console packages	Nessus	VMware ESX Local Security Checks	high
37788	CentOS 3 / 4 / 5 : perl (CESA-2007:0966)	Nessus	CentOS Local Security Checks	high
32241	AIX 5.2 TL 10 : perl.rte (U815030)	Nessus	AIX Local Security Checks	high
30933	AIX 5.3 TL 6 : perl.rte (U814193)	Nessus	AIX Local Security Checks	high
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
29550	SuSE 10 Security Update : perl (ZYPP Patch Number 4665)	Nessus	SuSE Local Security Checks	high
29237	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : perl vulnerability (USN-552-1)	Nessus	Ubuntu Local Security Checks	high
28286	openSUSE 10 Security Update : perl (perl-4675)	Nessus	SuSE Local Security Checks	high
28267	GLSA-200711-28 : Perl: Buffer overflow	Nessus	Gentoo Local Security Checks	high
28191	Fedora 7 : perl-5.8.8-26.fc7 (2007-3255)	Nessus	Fedora Local Security Checks	high
28188	Fedora 8 : perl-5.8.8-31.fc8 (2007-3218)	Nessus	Fedora Local Security Checks	high
27813	FreeBSD : perl -- regular expressions unicode data buffer overflow (5b47c279-8cb5-11dc-8878-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	high
27804	Debian DSA-1400-1 : perl - heap overflow	Nessus	Debian Local Security Checks	high
27644	RHEL 3 / 4 / 5 : perl (RHSA-2007:0966)	Nessus	Red Hat Local Security Checks	high
27642	Mandrake Linux Security Advisory : perl (MDKSA-2007:207)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2007-5116

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high