CVE-2013-1667: High severity perl 5.30.0 vulnerability

Published Feb 18, 2013

Updated

A denial of service flaw was found in the way Perl's rehashing code implementation (responsible for recalculation of hash keys and redistribution of hash content) used to react on certain user's input. If a Perl language based application accepted untrusted user input as hash keys, an attacker could use this flaw to cause the perl executable to consume excessive amount of memory (a denial of service via memory exhaustion).

References: [1] http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html

Other sources

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

— MITRE

Affected Software

61 affected components

Perl Perl=5.8.2

Perl Perl=5.8.3

Perl Perl=5.8.4

Perl Perl=5.8.5

Perl Perl=5.8.6

Perl Perl=5.8.7

Perl Perl=5.8.8

Perl Perl=5.8.9

Perl Perl=5.8.10

Perl Perl=5.10

Perl Perl=5.10.0

Perl Perl=5.10.0-rc1

Perl Perl=5.10.0-rc2

Perl Perl=5.10.1

Perl Perl=5.10.1-rc1

Perl Perl=5.10.1-rc2

Perl Perl=5.11.0

Perl Perl=5.11.1

Perl Perl=5.11.2

Perl Perl=5.11.3

Perl Perl=5.11.4

Perl Perl=5.11.5

Perl Perl=5.12.0

Perl Perl=5.12.0-rc0

Perl Perl=5.12.0-rc1

Perl Perl=5.12.0-rc2

Perl Perl=5.12.0-rc3

Perl Perl=5.12.0-rc4

Perl Perl=5.12.0-rc5

Perl Perl=5.12.1

Perl Perl=5.12.1-rc1

Perl Perl=5.12.1-rc2

Perl Perl=5.12.2

Perl Perl=5.12.2-rc1

Perl Perl=5.12.3

Perl Perl=5.12.3-rc1

Perl Perl=5.12.3-rc2

Perl Perl=5.12.3-rc3

Perl Perl=5.12.4

Perl Perl=5.13.0

Perl Perl=5.13.1

Perl Perl=5.13.2

Perl Perl=5.13.3

Perl Perl=5.13.4

Perl Perl=5.13.5

Perl Perl=5.13.6

Perl Perl=5.13.7

Perl Perl=5.13.8

Perl Perl=5.13.9

Perl Perl=5.13.10

Perl Perl=5.13.11

Perl Perl=5.14.0

Perl Perl=5.14.0-rc1

Perl Perl=5.14.0-rc2

Perl Perl=5.14.0-rc3

Perl Perl=5.14.1

Perl Perl=5.14.2

Perl Perl=5.14.3

Perl Perl=5.16.0

Perl Perl=5.16.1

Perl Perl=5.16.2

Event History

Feb 18, 2013

Data Sourced

09:31 AM

DescriptionSeverityAffected Software

Mar 12, 2013

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1667?

CVE-2013-1667 is classified as a denial of service vulnerability.

How do I fix CVE-2013-1667?

To fix CVE-2013-1667, upgrade to a patched version of Perl that addresses this vulnerability.

Which versions of Perl are affected by CVE-2013-1667?

CVE-2013-1667 affects multiple versions of Perl, specifically from 5.8.2 to 5.16.2.

What type of attacks can be executed using CVE-2013-1667?

CVE-2013-1667 can be exploited to launch denial of service attacks against Perl applications that accept untrusted input.

Is user input a factor in CVE-2013-1667?

Yes, untrusted user input as hash keys is a crucial factor in the exploitation of CVE-2013-1667.