PT-2007-4293 · Ibm+1 · Aix+2

Published 2007-06-04 · Updated 2012-10-31 · CVE-2007-2996

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: perl.rte versions 5.8.0.10 through 5.8.0.95 on IBM AIX 5.2 perl.rte versions 5.8.2.10 through 5.8.2.50 on AIX 5.3

Description: The issue allows local users to gain privileges via unspecified vectors related to the installation and waiting for a legitimate user to execute a binary that ships with Perl.

Recommendations: For perl.rte versions 5.8.0.10 through 5.8.0.95 on IBM AIX 5.2, update to a version outside of this range to resolve the issue. For perl.rte versions 5.8.2.10 through 5.8.2.50 on AIX 5.3, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the binaries that ship with Perl to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-2996

Affected Products

Aix

Perl

Perl.Rte

References · 10

• http://secunia.com/advisories/25478 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=isg1IY98394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2996 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=isg1IY98395 · Vendor Advisory
• ftp://aix.software.ibm.com/aix/efixes/security/perl_ifix.tar.Z · Patch
• http://securityfocus.com/bid/24241 · Patch
• http://www-1.ibm.com/support/search.wss?rs=0&q=IY98396&apar=only · Vendor Advisory
• http://securitytracker.com/id?1018177 · Note
• http://osvdb.org/36754 · Note
• http://vupen.com/english/advisories/2007/2004 · Note