Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.

The remote Solaris system is missing necessary patches to address security updates :

  - Race condition in the rmtree function in the File::Path     module in Perl 5.6.1 and 5.8.4 sets read/write     permissions for the world, which allows local users to     delete arbitrary files and directories, and possibly     read files and directories, via a symlink attack.
    (CVE-2004-0452)

  - Buffer overflow in the PerlIO implementation in Perl     5.8.0, when installed with setuid support (sperl),     allows local users to execute arbitrary code by setting     the PERLIO_DEBUG variable and executing a Perl script     whose full pathname contains a long directory tree.
    (CVE-2005-0156)

  - Race condition in the rmtree function in File::Path.pm     in Perl before 5.8.4 allows local users to create     arbitrary setuid binaries in the tree being deleted, a     different vulnerability than CVE-2004-0452.
    (CVE-2005-0448)

  - Untrusted search path vulnerability in Perl before     5.8.7-r1 on Gentoo Linux allows local users in the     portage group to gain privileges via a malicious shared     object in the Portage temporary build directory, which     is part of the RUNPATH. (CVE-2005-4278)

  - Integer overflow in the regular expression engine in     Perl 5.8.x allows context-dependent attackers to cause a     denial of service (stack consumption and application     crash) by matching a crafted regular expression against     a long string. (CVE-2010-1158)

  - Off-by-one error in the decode_xs function in     Unicode/Unicode.xs in the Encode module before 2.44, as     used in Perl before 5.15.6, might allow     context-dependent attackers to cause a denial of service     (memory corruption) via a crafted Unicode string, which     triggers a heap-based buffer overflow. (CVE-2011-2939)

  - CGI.pm module before 3.63 for Perl does not properly     escape newlines in (1) Set-Cookie or (2) P3P headers,     which might allow remote attackers to inject arbitrary     headers into responses from applications that use     CGI.pm. (CVE-2012-5526)

This update of Perl fixes a heap based buffer overflow in the decode_xs() function (CVE-2011-2939, bnc#728662).

Update to version 1.1.4 of icedtea-web to fix the following issues :

  - CVE-2011-3377: IcedTea-Web: second-level domain     subdomains and suffix domain SOP bypass

  - PR778: Jar download and server certificate verification     deadlock

The remote host is affected by the vulnerability described in GLSA-201401-11 (Perl, Locale Maketext Perl module: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Perl and       Locale::Maketext Perl module. Please review the CVE identifiers       referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

A heap-based buffer overflow flaw was found in the way Perl decoded Unicode strings. An attacker could create a malicious Unicode string that, when decoded by a Perl program, would cause the program to crash or, potentially, execute arbitrary code with the permissions of the user running the program. (CVE-2011-2939)

It was found that the 'new' constructor of the Digest module used its argument as part of the string expression passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary Perl code with the privileges of a Perl program that uses untrusted input as an argument to the constructor. (CVE-2011-3597)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1424 advisory.

    - 731246 (CVE-2011-2939)CVE-2011-2939 heap overflow - decoding Unicode string

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the decode_xs function in the Encode module is vulnerable to a heap-based buffer overflow via a crafted Unicode string. An attacker could use this overflow to cause a denial of service. (CVE-2011-2939)

It was discovered that the 'new' constructor in the Digest module is vulnerable to an eval injection. An attacker could use this to execute arbitrary code. (CVE-2011-3597)

It was discovered that Perl's 'x' string repeat operator is vulnerable to a heap-based buffer overflow. An attacker could use this to execute arbitrary code. (CVE-2012-5195)

Ryo Anazawa discovered that the CGI.pm module does not properly escape newlines in Set-Cookie or P3P (Platform for Privacy Preferences Project) headers. An attacker could use this to inject arbitrary headers into responses from applications that use CGI.pm.
(CVE-2012-5526).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Perl is a high-level programming language commonly used for system administration utilities and web programming.

A heap-based buffer overflow flaw was found in the way Perl decoded Unicode strings. An attacker could create a malicious Unicode string that, when decoded by a Perl program, would cause the program to crash or, potentially, execute arbitrary code with the permissions of the user running the program. (CVE-2011-2939)

It was found that the 'new' constructor of the Digest module used its argument as part of the string expression passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary Perl code with the privileges of a Perl program that uses untrusted input as an argument to the constructor. (CVE-2011-3597)

All Perl users should upgrade to these updated packages, which contain backported patches to correct these issues. All running Perl programs must be restarted for this update to take effect.

Multiple vulnerabilities has been found and corrected in perl :

Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow (CVE-2011-2939).

Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor (CVE-2011-3597).

The updated packages have been patched to correct these issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1424 advisory.

    Perl is a high-level programming language commonly used for system     administration utilities and web programming.

    A heap-based buffer overflow flaw was found in the way Perl decoded Unicode     strings. An attacker could create a malicious Unicode string that, when     decoded by a Perl program, would cause the program to crash or,     potentially, execute arbitrary code with the permissions of the user     running the program. (CVE-2011-2939)

    It was found that the new constructor of the Digest module used its     argument as part of the string expression passed to the eval() function. An     attacker could possibly use this flaw to execute arbitrary Perl code with     the privileges of a Perl program that uses untrusted input as an argument     to the constructor. (CVE-2011-3597)

    All Perl users should upgrade to these updated packages, which contain     backported patches to correct these issues. All running Perl programs must     be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes security bug in Digest object constructor (CVE-2011-3597)= and in decoding Unicode string by interpreter (CVE-2011-2939).
----------------------------------------------------------------------
-----=

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80731	Oracle Solaris Third-Party Patch Update : perl-58 (cve_2012_5526_configuration_vulnerability1)	Nessus	Solaris Local Security Checks	high
75994	openSUSE Security Update : perl (openSUSE-SU-2011:1278-1)	Nessus	SuSE Local Security Checks	medium
75865	openSUSE Security Update : icedtea-web (openSUSE-SU-2011:1251-1)	Nessus	SuSE Local Security Checks	medium
75707	openSUSE Security Update : perl (openSUSE-SU-2011:1278-1)	Nessus	SuSE Local Security Checks	medium
75529	openSUSE Security Update : icedtea-web (openSUSE-SU-2011:1251-1)	Nessus	SuSE Local Security Checks	medium
72033	GLSA-201401-11 : Perl, Locale Maketext Perl module: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69578	Amazon Linux AMI : perl (ALAS-2011-19)	Nessus	Amazon Linux Local Security Checks	high
68383	Oracle Linux 6 : perl (ELSA-2011-1424)	Nessus	Oracle Linux Local Security Checks	critical
63109	Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : perl vulnerabilities (USN-1643-1)	Nessus	Ubuntu Local Security Checks	high
61169	Scientific Linux Security Update : perl on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
57593	Mandriva Linux Security Advisory : perl (MDVSA-2012:008)	Nessus	Mandriva Local Security Checks	high
56709	RHEL 6 : perl (RHSA-2011:1424)	Nessus	Red Hat Local Security Checks	critical
56696	Fedora 14 : perl-5.12.4-147.fc14 (2011-13874)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-2939

critical

Tenable Plugins

high

medium

medium

medium

medium

high

high

critical

high

high

high

critical

high