PT-2005-4702 · Perl+1 · Perl+1
Jack Louis
·
Publicado
2005-12-01
·
Atualizado
2024-06-15
·
CVE-2005-3962
CVSS v2.0
4.6
Média
| Vetor | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Perl versions 5.8.6 through 5.9.2
Description
The issue is related to an integer overflow in the format string functionality, specifically in the
Perl sv vcatpvfn function. This allows attackers to potentially overwrite arbitrary memory and execute arbitrary code by using format string specifiers with large values, causing an integer wrap that leads to a buffer overflow.Recommendations
For Perl versions 5.8.6 through 5.9.2, consider applying configuration changes to restrict the use of format string specifiers until a patch is available.
As a temporary workaround, restrict access to the
Perl sv vcatpvfn function to minimize the risk of exploitation.
Avoid using large values in format string specifiers in the affected Perl applications until the issue is resolved.Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Perl
Red Hat