PT-2016-3420 · Perl+2 · Perl+2
John Lightsey
+1
·
Publicado
2016-07-25
·
Atualizado
2025-04-01
·
CVE-2016-1238
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Perl versions prior to 5.22.3-RC2
Perl versions 5.24 prior to 5.24.1-RC2
Description
The issue is related to errors in privilege management in the Perl interpreter, specifically with the handling of the included directory array ("@INC"). This could allow a local user to gain privileges via a Trojan horse module under the current working directory by exploiting the failure to properly remove period characters from the end of the includes directory array.
Recommendations
For Perl versions prior to 5.22.3-RC2, update to version 5.22.3-RC2 or later.
For Perl versions 5.24 prior to 5.24.1-RC2, update to version 5.24.1-RC2 or later.
As a temporary workaround, consider restricting access to the vulnerable modules under the current working directory to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Perl
Suse