CVE-2004-2022: Buffer Overflow

Published Dec 31, 2004

Updated

ActivePerl 5.8.x and others, and Larry Wall's Perl 5.6.1 and others, when running on Windows systems, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to the system command, which leads to a stack-based buffer overflow. NOTE: it is unclear whether this bug is in Perl or the OS API that is used by Perl.

Affected Software

8 affected components

Activestate ActivePerl=5.6.1

Activestate ActivePerl=5.6.1.630

Activestate ActivePerl=5.6.2

Activestate ActivePerl=5.6.3

Activestate ActivePerl=5.7.1

Activestate ActivePerl=5.7.2

Activestate ActivePerl=5.7.3

Activestate ActivePerl=5.8

Event History

Dec 31, 2004

CVE Published

05:00 AM

May 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2022?

CVE-2004-2022 is classified as a high severity vulnerability due to its potential to cause denial of service and execute arbitrary code.

How does CVE-2004-2022 exploit the system?

CVE-2004-2022 exploits a stack-based buffer overflow vulnerability by passing a long argument to the system command.

Which versions of ActivePerl are affected by CVE-2004-2022?

ActivePerl versions 5.6.1, 5.6.2, 5.6.3, 5.7.1, 5.7.2, 5.7.3, and 5.8 are affected by CVE-2004-2022.

How can I mitigate the risks associated with CVE-2004-2022?

To mitigate the risks of CVE-2004-2022, it is recommended to upgrade to a patched version of ActivePerl that addresses this vulnerability.

What are the potential impacts of CVE-2004-2022 on systems?

The potential impacts of CVE-2004-2022 include system crashes and the possibility of attackers executing arbitrary code on affected systems.