PT-2012-5832 · Perl+2 · Perl+2

Tim Brown · Published 2012-12-18 · Updated 2016-12-08 · CVE-2012-5195

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Perl versions 5.12.x through 5.12.4 Perl versions 5.14.x through 5.14.2 Perl versions 5.15.x through 5.15.4

Description The issue is related to a heap-based buffer overflow in the Perl repeatcpy function, which can be exploited by context-dependent attackers. This can lead to a denial of service due to memory consumption and crash, or potentially allow the execution of arbitrary code. The exploitation is possible via the 'x' string repeat operator.

Recommendations For Perl versions 5.12.x through 5.12.4, update to version 5.12.5 or later. For Perl versions 5.14.x through 5.14.2, update to version 5.14.3 or later. For Perl versions 5.15.x through 5.15.4, update to version 5.15.5 or later.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2013_0685

CVE-2012-5195

DSA-2586-1

RHSA-2013:0685

RHSA-2013_0685

Affected Products

Centos

Perl

Red Hat

References · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/foswiki_maketext.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/twiki_maketext.rb · Exploit
• https://linux.oracle.com/errata/ELSA-2013-0685.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02626 · Security Note
• http://debian.org/security/2012/dsa-2586 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:113 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-5195 · Vendor Advisory
• http://secunia.com/advisories/51457 · Vendor Advisory
• http://perl5.git.perl.org/perl.git/commit/2709980d5a193ce6f3a16f0d19879a6560dcde44 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6329 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5195 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5526 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-5195 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0685.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1667 · Security Note