CVE-2004-2286: Buffer Overflow

Published Dec 31, 2004

Updated

Integer overflow in the duplication operator in ActivePerl allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large multiplier, which may trigger a buffer overflow.

Affected Software

20 affected components

Activestate ActivePerl=5.6.1

Activestate ActivePerl=5.6.1.630

Activestate ActivePerl=5.6.2

Activestate ActivePerl=5.6.3

Activestate ActivePerl=5.7.1

Activestate ActivePerl=5.7.2

Activestate ActivePerl=5.7.3

Activestate ActivePerl=5.8

Activestate ActivePerl=5.8.1

Activestate ActivePerl=5.8.3

Larry Wall Perl=5.3

Larry Wall Perl=5.4

Larry Wall Perl=5.4.5

Larry Wall Perl=5.5

Larry Wall Perl=5.5.3

Larry Wall Perl=5.6

Larry Wall Perl=5.6.1

Larry Wall Perl=5.8.0

Larry Wall Perl=5.8.1

Larry Wall Perl=5.8.3

Event History

Dec 31, 2004

CVE Published

05:00 AM

Aug 4, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2286?

The severity of CVE-2004-2286 is considered high, as it can lead to denial of service and potentially arbitrary code execution.

How do I fix CVE-2004-2286?

To fix CVE-2004-2286, upgrade to the latest version of ActivePerl or Perl that addresses this integer overflow vulnerability.

What types of software are affected by CVE-2004-2286?

CVE-2004-2286 affects various versions of ActivePerl and Perl, specifically versions 5.3 to 5.8.3.

Can CVE-2004-2286 be exploited remotely?

Yes, CVE-2004-2286 can be exploited remotely by sending a carefully crafted request that uses a large multiplier.

Is CVE-2004-2286 a common vulnerability?

CVE-2004-2286 is recognized but older, and while it was a concern in its time, it is less common today due to patches and updates in affected software.