REDHAT-BUG-692898
First published: Fri Apr 01 2011(Updated: )
A security flaw was found in the way Perl performed laundering of tainted data. A remote attacker could use this flaw to bypass Perl TAINT mode protection mechanism (leading to commands execution on dirty arguments or file system access via contaminated variables) via specially-crafted input provided to the web application / CGI script. Upstream bug report: <a href="http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336">http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336</a> Relevant patch: <a href="http://perl5.git.perl.org/perl.git/commitdiff/539689e74a3bcb04d29e4cd9396de91a81045b99">http://perl5.git.perl.org/perl.git/commitdiff/539689e74a3bcb04d29e4cd9396de91a81045b99</a> References: [1] <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED DUPLICATE - lc launders tainted flag" href="show_bug.cgi?id=692844">https://bugzilla.redhat.com/show_bug.cgi?id=692844</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Perl 5.30.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336
- http://perl5.git.perl.org/perl.git/commitdiff/539689e74a3bcb04d29e4cd9396de91a81045b99
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=692844
- http://www.openwall.com/lists/oss-security/2011/04/01/3
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=692900
- http://www.openwall.com/lists/oss-security/2011/04/04/35
- https://rhn.redhat.com/errata/RHSA-2011-0558.html
- https://bugzilla.redhat.com/show_bug.cgi?id=692898
Frequently Asked Questions
What is the severity of REDHAT-BUG-692898?
The severity of REDHAT-BUG-692898 is considered critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-692898?
To fix REDHAT-BUG-692898, update Perl to the latest version that includes the security patch addressing this vulnerability.
What systems are affected by REDHAT-BUG-692898?
REDHAT-BUG-692898 primarily affects systems running Perl that employ TAINT mode for data sanitation.
What can an attacker achieve with REDHAT-BUG-692898?
An attacker exploiting REDHAT-BUG-692898 could execute arbitrary commands or gain unauthorized file system access.
Is there a workaround for REDHAT-BUG-692898?
While updating Perl is the recommended solution, restricting input to trusted sources can serve as a temporary workaround for REDHAT-BUG-692898.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1487
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/perl
- canonical/perl 5.30.0