The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0558 advisory.

  - The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier     uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows     remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted     input that contains this value, a different vulnerability than CVE-2010-3172. (CVE-2010-2761)

  - CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in     CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP     response splitting attacks via vectors related to non-whitespace characters preceded by newline     characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172. (CVE-2010-4410)

  - The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through     5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing     tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via     a crafted string. (CVE-2011-1487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes a bug in perl that makes spamassassin crash and does not allow bypassing taint mode by using lc() or uc() anymore.

  - CVE-2010-4777: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P)

  - CVE-2011-1487: CVSS v2 Base Score: 2.6     (AV:N/AC:H/Au:N/C:N/I:P/A:N): Permissions, Privileges,     and Access Control (CWE-264)

The remote host is affected by the vulnerability described in GLSA-201311-17 (Perl: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Perl. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could cause a Denial of Service condition or perform       symlink attacks to overwrite arbitrary files with the privileges of the       user running the application. A context-dependent attacker could cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Perl CGI module provides resources for preparing and processing Common Gateway Interface (CGI) based HTTP requests and responses.

It was found that the Perl CGI module used a hard-coded value for the MIME boundary string in multipart/x-mixed-replace content. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially crafted HTTP request. (CVE-2010-2761)

A CRLF injection flaw was found in the way the Perl CGI module processed a sequence of non-whitespace preceded by newline characters in the header. A remote attacker could use this flaw to conduct an HTTP response splitting attack via a specially crafted sequence of characters provided to the CGI module. (CVE-2010-4410)

It was found that certain Perl string manipulation functions (such as uc() and lc()) failed to preserve the taint bit. A remote attacker could use this flaw to bypass the Perl taint mode protection mechanism in scripts that use the affected functions to process tainted input.
(CVE-2011-1487)

These packages upgrade the CGI module to version 3.51. Refer to the CGI module's Changes file, linked to in the References, for a full list of changes.

This update also fixes the following bugs :

  - When using the 'threads' module, an attempt to send a     signal to a thread that did not have a signal handler     specified caused the perl interpreter to terminate     unexpectedly with a segmentation fault. With this     update, the 'threads' module has been updated to     upstream version 1.82, which fixes this bug. As a     result, sending a signal to a thread that does not have     the signal handler specified no longer causes perl to     cras

  - Prior to this update, the perl packages did not require     the Digest::SHA module as a dependency. Consequent to     this, when a user started the cpan command line     interface and attempted to download a distribution from     CPAN, they may have been presented with the following     message :

CPAN: checksum security checks disabled because Digest::SHA not installed. Please consider installing the Digest::SHA module.

This update corrects the spec file for the perl package to require the perl-Digest-SHA package as a dependency, and cpan no longer displays the above message.

  - When using the 'threads' module, continual creation and     destruction of threads could cause the Perl program to     consume an increasing amount of memory. With this     update, the underlying source code has been corrected to     free the allocated memory when a thread is destroyed,     and the continual creation and destruction of threads in     Perl programs no longer leads to memory leaks.

  - Due to a packaging error, the perl packages did not     include the 'NDBM_File' module. This update corrects     this error, and 'NDBM_File' is now included as expected.

  - Prior to this update, the prove(1) manual page and the     'prove --help' command listed '--fork' as a valid     command line option. However, version 3.17 of the     Test::Harness distribution removed the support for the     fork-based parallel testing, and the prove utility thus     no longer supports this option. This update corrects     both the manual page and the output of the 'prove
    --help' command, so that '--fork' is no longer included     in the list of available command line options.

Users of Perl, especially those of Perl threads, are advised to upgrade to these updated packages, which correct these issues.

This update fixes a bug in perl that allowed bypassing taint mode by using lc() or uc(). CVE-2011-1487: CVSS v2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N): Permissions, Privileges, and Access Control. (CWE-264)

Mark Martinec discovered that Perl incorrectly clears the tainted flag on values returned by case conversion functions such as 'lc'. This may expose preexisting vulnerabilities in applications which use these functions while processing untrusted input. No such applications are known at this stage. Such applications will cease to work when this security update is applied because taint checks are designed to prevent such unsafe use of untrusted input data.

It was discovered that the Safe.pm Perl module incorrectly handled Safe::reval and Safe::rdo access restrictions. An attacker could use this flaw to bypass intended restrictions and possibly execute arbitrary code. (CVE-2010-1168, CVE-2010-1447)

It was discovered that the CGI.pm Perl module incorrectly handled certain MIME boundary strings. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-2761, CVE-2010-4411)

It was discovered that the CGI.pm Perl module incorrectly handled newline characters. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-4410)

It was discovered that the lc, lcfirst, uc, and ucfirst functions did not properly apply the taint attribute when processing tainted input.
An attacker could use this flaw to bypass intended restrictions. This issue only affected Ubuntu 8.04 LTS, 10.04 LTS and 10.10.
(CVE-2011-1487).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0558 advisory.

    Perl is a high-level programming language commonly used for system     administration utilities and web programming. The Perl CGI module provides     resources for preparing and processing Common Gateway Interface (CGI) based     HTTP requests and responses.

    It was found that the Perl CGI module used a hard-coded value for the MIME     boundary string in multipart/x-mixed-replace content. A remote attacker     could possibly use this flaw to conduct an HTTP response splitting attack     via a specially-crafted HTTP request. (CVE-2010-2761)

    A CRLF injection flaw was found in the way the Perl CGI module processed a     sequence of non-whitespace preceded by newline characters in the header. A     remote attacker could use this flaw to conduct an HTTP response splitting     attack via a specially-crafted sequence of characters provided to the CGI     module. (CVE-2010-4410)

    It was found that certain Perl string manipulation functions (such as uc()     and lc()) failed to preserve the taint bit. A remote attacker could use     this flaw to bypass the Perl taint mode protection mechanism in scripts     that use the affected functions to process tainted input. (CVE-2011-1487)

    These packages upgrade the CGI module to version 3.51. Refer to the CGI     module's Changes file, linked to in the References, for a full list of     changes.

    This update also fixes the following bugs:

    * When using the threads module, an attempt to send a signal to a thread     that did not have a signal handler specified caused the perl interpreter to     terminate unexpectedly with a segmentation fault. With this update, the     threads module has been updated to upstream version 1.82, which fixes     this bug. As a result, sending a signal to a thread that does not have the     signal handler specified no longer causes perl to crash. (BZ#626330)

    * Prior to this update, the perl packages did not require the Digest::SHA     module as a dependency. Consequent to this, when a user started the cpan     command line interface and attempted to download a distribution from CPAN,     they may have been presented with the following message:

    CPAN: checksum security checks disabled because Digest::SHA not installed.
    Please consider installing the Digest::SHA module.

    This update corrects the spec file for the perl package to require the     perl-Digest-SHA package as a dependency, and cpan no longer displays the     above message. (BZ#640716)

    * When using the threads module, continual creation and destruction of     threads could cause the Perl program to consume an increasing amount of     memory. With this update, the underlying source code has been corrected to     free the allocated memory when a thread is destroyed, and the continual     creation and destruction of threads in Perl programs no longer leads to     memory leaks. (BZ#640720)

    * Due to a packaging error, the perl packages did not include the     NDBM_File module. This update corrects this error, and NDBM_File is now     included as expected. (BZ#640729)

    * Prior to this update, the prove(1) manual page and the prove --help     command listed --fork as a valid command line option. However, version     3.17 of the Test::Harness distribution removed the support for the     fork-based parallel testing, and the prove utility thus no longer supports     this option. This update corrects both the manual page and the output of     the prove --help command, so that --fork is no longer included in the     list of available command line options. (BZ#609492)

    Users of Perl, especially those of Perl threads, are advised to upgrade to     these updated packages, which correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability has been found and corrected in perl :

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string (CVE-2011-1487).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

This update fixes a bug in Perl that makes spamassassin crash and does not allow bypassing taint mode by using lc() or uc() anymore.

  - CVE-2010-4777: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P)

  - CVE-2011-1487: CVSS v2 Base Score: 2.6     (AV:N/AC:H/Au:N/C:N/I:P/A:N): Permissions, Privileges,     and Access Control (CWE-264)

Security bug: lc launder tainted data

http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security bug: lc launder tainted data

http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336

Cwd.so should go the subpackage.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
181090	Oracle Linux 6 : perl (ELSA-2011-0558)	Nessus	Oracle Linux Local Security Checks	critical
75993	openSUSE Security Update : perl (openSUSE-SU-2011:0479-1)	Nessus	SuSE Local Security Checks	medium
75706	openSUSE Security Update : perl (openSUSE-SU-2011:0479-1)	Nessus	SuSE Local Security Checks	medium
71119	GLSA-201311-17 : Perl: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
61044	Scientific Linux Security Update : perl on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57240	SuSE 10 Security Update : Perl (ZYPP Patch Number 7507)	Nessus	SuSE Local Security Checks	medium
55280	Debian DSA-2265-1 : perl - lack of tainted flag propagation	Nessus	Debian Local Security Checks	medium
55090	Ubuntu 6.06 LTS / 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : perl vulnerabilities (USN-1129-1)	Nessus	Ubuntu Local Security Checks	high
54593	RHEL 6 : perl (RHSA-2011:0558)	Nessus	Red Hat Local Security Checks	critical
54577	Mandriva Linux Security Advisory : perl (MDVSA-2011:091)	Nessus	Mandriva Local Security Checks	medium
53894	SuSE 10 Security Update : Perl (ZYPP Patch Number 7508)	Nessus	SuSE Local Security Checks	medium
53892	SuSE 11.1 Security Update : Perl (SAT Patch Number 4499)	Nessus	SuSE Local Security Checks	medium
53887	openSUSE Security Update : perl (openSUSE-SU-2011:0479-1)	Nessus	SuSE Local Security Checks	medium
53541	Fedora 13 : perl-5.10.1-123.fc13 (2011-4918)	Nessus	Fedora Local Security Checks	medium
53453	Fedora 15 : perl-5.12.3-156.fc15 (2011-4631)	Nessus	Fedora Local Security Checks	medium
53406	Fedora 14 : perl-5.12.3-143.fc14 (2011-4610)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1487

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

high

critical

medium

medium

medium

medium

medium

medium

medium