CVE-2011-1487: Medium severity perl 5.30.0 vulnerability
A security flaw was found in the way Perl performed laundering of tainted data. A remote attacker could use this flaw to bypass Perl TAINT mode protection mechanism (leading to commands execution on dirty arguments or file system access via contaminated variables) via specially-crafted input provided to the web application / CGI script.
Upstream bug report: http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336
Relevant patch: http://perl5.git.perl.org/perl.git/commitdiff/539689e74a3bcb04d29e4cd9396de91a81045b99
References: [1] https://bugzilla.redhat.com/showbug.cgi?id=692844
Other sources
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1487?
CVE-2011-1487 has a moderate severity as it allows attackers to bypass the Perl TAINT mode protection mechanism.
How do I fix CVE-2011-1487?
To fix CVE-2011-1487, users should upgrade to the latest patched version of Perl that addresses this vulnerability.
Which versions of Perl are affected by CVE-2011-1487?
CVE-2011-1487 affects Perl versions 5.10.0, 5.10.1, 5.11.x, and 5.12.x among others.
What kind of attacks can be executed due to CVE-2011-1487?
Exploitation of CVE-2011-1487 could lead to code execution on dirty arguments or unauthorized file system access.
Is there a known exploit for CVE-2011-1487?
Yes, CVE-2011-1487 has been discussed in security circles, but specific exploits would depend on the context and implementation.