Detections
Analytics
AIX 7.2 TL 3 : perl (IJ26986)
high Nessus Plugin ID 144320
Language:
Synopsis
The remote AIX host is missing a security patch.Description
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Perl before 5.30.3 has an integer overflow related to mishandling of a 'PL_regkind[OP(n)] == NOTHING' situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.Solution
Install the appropriate interim fix.See Also
https://aix.software.ibm.com/aix/efixes/security/perl_advisory5.asc
Plugin Details
Severity: High
ID: 144320
File Name: aix_IJ26986.nasl
Version: 1.8
Type: local
Family: AIX Local Security Checks
Published: 12/16/2020
Updated: 2/6/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-10878
CVSS v3
Risk Factor: High
Base Score: 8.6
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:ibm:aix:7.2
Required KB Items: Host/local_checks_enabled, Host/AIX/version, Host/AIX/lslpp
Exploit Ease: No known exploits are available
Patch Publication Date: 12/9/2020
Vulnerability Publication Date: 12/9/2020