FreeBSD : eperl -- Remote code execution (73efb1b7-07ec-11e2-a391-000c29033c32)

high Nessus Plugin ID 62341

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

David Madison reports :

ePerl is a multipurpose Perl filter and interpreter program for Unix systems. The ePerl preprocessor contains an input validation error.
The preprocessor allows foreign data to be 'safely' included using the 'sinclude' directive.

The problem occurs when a file referenced by a 'sinclude' directive contains a 'include' directive; the contents of the file referred to by the second directive will be loaded and executed.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 62341

File Name: freebsd_pkg_73efb1b707ec11e2a391000c29033c32.nasl

Version: 1.9

Type: local

Family: FreeBSD Local Security Checks

Published: 9/27/2012

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:eperl

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 9/26/2012

Vulnerability Publication Date: 6/21/2001

Reference Information

CVE: CVE-2001-0733

BID: 2912

Detections

Analytics