PT-2012-1220 · Perl+1 · Perl+1

Petr Pisar · Published 2012-12-21 · Updated 2013-01-29 · CVE-2011-2728

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Perl versions prior to 5.14.2

Description The issue is related to the bsd glob function in the File::Glob module for Perl, which allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB ALTDIRFUNC flag. This triggers an uninitialized pointer dereference. The vulnerability is also associated with resource release errors. Exploitation may allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 5.14.2, update to version 5.14.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of the GLOB ALTDIRFUNC flag in the bsd glob function until a patch is available. Restrict access to the bsd glob function to minimize the risk of exploitation. Avoid using the bsd glob function with untrusted input until the issue is resolved.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2022-02612

CVE-2011-2728

Affected Products

Perl

Suse

References · 13

• http://secunia.com/advisories/46172 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2728 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2728 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-November/069752.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-2728 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2728 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=742987 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2728 · Note
• http://securityfocus.com/bid/49858 · Note
• http://perl5.git.perl.org/perl.git/commit/1af4051e077438976a4c12a0622feaf6715bec77 · Note
• https://blogs.oracle.com/sunsecurity/entry/cve_2011_2728_denial_of1 · Note
• http://cpansearch.perl.org/src/FLORA/perl-5.14.2/pod/perldelta.pod · Note