PT-2019-6560 · Perl · Libpoe-Component-Irc-Perl

Vincent Danen · Publicado 2019-11-12 · Atualizado 2019-11-15 · CVE-2010-3438

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libpoe-component-irc-perl versions prior to 6.32

Description The issue allows execution of arbitrary IRC commands by passing a specially crafted argument to the 'privmsg' handler, potentially causing the client to disconnect from the server. This can be achieved by including carriage returns and line feeds in the argument, such as "some textrQUIT".

Recommendations For versions prior to 6.32, consider removing or properly handling carriage returns and line feeds in arguments passed to the 'privmsg' handler to prevent arbitrary IRC command execution. As a temporary workaround, restrict the use of the 'privmsg' handler until a proper fix is applied.

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2010-3438

Produtos afetados

Libpoe-Component-Irc-Perl

Referências · 6

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581194 · Correção
• https://security-tracker.debian.org/tracker/CVE-2010-3438 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3438 · Correção
• https://osv.dev/vulnerability/CVE-2010-3438 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3438 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-3438 · Nota de Segurança