PT-2007-4293 · Ibm+1 · Aix+2

Publicado 2007-06-04 · Atualizado 2012-10-31 · CVE-2007-2996

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: perl.rte versions 5.8.0.10 through 5.8.0.95 on IBM AIX 5.2 perl.rte versions 5.8.2.10 through 5.8.2.50 on AIX 5.3

Description: The issue allows local users to gain privileges via unspecified vectors related to the installation and waiting for a legitimate user to execute a binary that ships with Perl.

Recommendations: For perl.rte versions 5.8.0.10 through 5.8.0.95 on IBM AIX 5.2, update to a version outside of this range to resolve the issue. For perl.rte versions 5.8.2.10 through 5.8.2.50 on AIX 5.3, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the binaries that ship with Perl to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-2996

Produtos afetados

Aix

Perl

Perl.Rte

Referências · 10

• http://securitytracker.com/id?1018177 · Nota
• http://secunia.com/advisories/25478 · Aviso do Fabricante
• http://www-1.ibm.com/support/docview.wss?uid=isg1IY98394 · Aviso do Fabricante
• http://osvdb.org/36754 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2996 · Nota de Segurança
• http://www-1.ibm.com/support/docview.wss?uid=isg1IY98395 · Aviso do Fabricante
• ftp://aix.software.ibm.com/aix/efixes/security/perl_ifix.tar.Z · Correção
• http://vupen.com/english/advisories/2007/2004 · Nota
• http://securityfocus.com/bid/24241 · Correção
• http://www-1.ibm.com/support/search.wss?rs=0&q=IY98396&apar=only · Aviso do Fabricante