An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - perl-dbi: Buffer overflow on an overlong DBD class name (CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for     Callbacks may lead to memory corruption. (CVE-2013-7490)

  - An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-     defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.
    (CVE-2013-7491)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - perl-dbi: Buffer overflow on an overlong DBD class name (CVE-2020-14393)

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

  - An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL     pointer dereference. (CVE-2019-20919)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - A buffer overflow was found in perl-DBI before version     1.643 in DBI.xs. This flaw allows a local attacker who     can supply a string longer than 300 characters to cause     an out-of-bounds write. The highest threat from this     vulnerability is to integrity and system     availability.(CVE-2020-14393)

  - An untrusted pointer dereference flaw was found in     Perl-DBI before version 1.643. This flaw allows a local     attacker who can manipulate calls to dbd_db_login6_sv()     to cause memory corruption. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14510-1 advisory.

  - An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for     Callbacks may lead to memory corruption. (CVE-2013-7490)

  - An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-     defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.
    (CVE-2013-7491)

  - An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL     pointer dereference. (CVE-2019-20919)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

CVE-2019-20919: Fixed a NULL profile dereference in dbi_profile (bsc#1176764).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

CVE-2019-20919: Fixed a NULL profile dereference in dbi_profile (bsc#1176764).

CVE-2013-7490: Fixed memory corruption when using many arguments to methods for CallbacksUsing (bsc#1176496).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

  - CVE-2019-20919: Fixed a NULL profile dereference in     dbi_profile (bsc#1176764).

This update was imported from the SUSE:SLE-15:Update update project.

This update for perl-DBI fixes the following issues :

  - CVE-2019-20919: Fixed a NULL profile dereference in     dbi_profile (bsc#1176764).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Several vulnerabilities were discovered in the Perl5 Database Interface (DBI). An attacker could trigger a denial of service (DoS) and possibly execute arbitrary code.

CVE-2019-20919

The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.

CVE-2020-14392

An untrusted pointer dereference flaw was found in Perl-DBI. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.

CVE-2020-14393

A buffer overflow on via an overlong DBD class name in dbih_setup_handle function may lead to data be written past the intended limit.

For Debian 9 stretch, these problems have been fixed in version 1.636-1+deb9u1.

We recommend that you upgrade your libdbi-perl packages.

For the detailed security status of libdbi-perl please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libdbi-perl

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release fixes CVE-2020-14392 (a memory corruption in XS functions when Perl stack is reallocated), CVE-2019-20919 (a NULL profile dereference in dbi_profile()), a documentation that old API functions are vulnerable to an overflow, and CVE-2020-14393 (a buffer overlfow on an overlong DBD class name). It also adds a missing dependency on FileHandle Perl module.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4534-1 advisory.

    It was discovered that Perl DBI module incorrectly handled certain inputs. An attacker could possibly use     this issue to cause a crash or expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199516	RHEL 7 : perl-dbi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199492	RHEL 8 : perl-dbi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195664	RHEL 5 : perl-dbi (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195605	RHEL 6 : perl-dbi (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
151418	EulerOS Virtualization 3.0.2.2 : perl-DBI (EulerOS-SA-2021-2158)	Nessus	Huawei Local Security Checks	high
151304	EulerOS Virtualization for ARM 64 3.0.2.0 : perl-DBI (EulerOS-SA-2021-2112)	Nessus	Huawei Local Security Checks	high
150556	SUSE SLES11 Security Update : perl-DBI (SUSE-SU-2020:14510-1)	Nessus	SuSE Local Security Checks	medium
147693	EulerOS Virtualization 2.9.0 : perl-DBI (EulerOS-SA-2021-1650)	Nessus	Huawei Local Security Checks	high
147556	EulerOS Virtualization 2.9.1 : perl-DBI (EulerOS-SA-2021-1622)	Nessus	Huawei Local Security Checks	high
147132	EulerOS Virtualization 3.0.6.6 : perl-DBI (EulerOS-SA-2021-1510)	Nessus	Huawei Local Security Checks	high
147044	EulerOS Virtualization for ARM 64 3.0.6.0 : perl-DBI (EulerOS-SA-2021-1552)	Nessus	Huawei Local Security Checks	high
145186	EulerOS 2.0 SP3 : perl-DBI (EulerOS-SA-2021-1109)	Nessus	Huawei Local Security Checks	high
144233	EulerOS 2.0 SP5 : perl-DBI (EulerOS-SA-2020-2559)	Nessus	Huawei Local Security Checks	high
143718	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:2827-1)	Nessus	SuSE Local Security Checks	medium
143690	SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2020:2856-1)	Nessus	SuSE Local Security Checks	medium
143678	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:2828-1)	Nessus	SuSE Local Security Checks	medium
142312	EulerOS 2.0 SP2 : perl-DBI (EulerOS-SA-2020-2382)	Nessus	Huawei Local Security Checks	high
142164	EulerOS 2.0 SP8 : perl-DBI (EulerOS-SA-2020-2315)	Nessus	Huawei Local Security Checks	high
141339	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2180)	Nessus	Huawei Local Security Checks	medium
141333	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2170)	Nessus	Huawei Local Security Checks	medium
141281	openSUSE Security Update : perl-DBI (openSUSE-2020-1620)	Nessus	SuSE Local Security Checks	medium
141279	openSUSE Security Update : perl-DBI (openSUSE-2020-1628)	Nessus	SuSE Local Security Checks	medium
140934	Debian DLA-2386-1 : libdbi-perl security update	Nessus	Debian Local Security Checks	high
140817	Fedora 31 : perl-DBI (2020-f30298614a)	Nessus	Fedora Local Security Checks	high
140752	Ubuntu 16.04 LTS / 18.04 LTS : Perl DBI module vulnerability (USN-4534-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2019-20919

medium

Tenable Plugins

high

high

high

high

high

high

medium

high

high

high

high

high

high

medium

medium

medium

high

high

medium

medium

medium

medium

high

high

medium