PT-2016-3420 · Perl+2 · Perl+2
John Lightsey
+1
·
Published
2016-07-25
·
Updated
2025-04-01
·
CVE-2016-1238
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Perl versions prior to 5.22.3-RC2
Perl versions 5.24 prior to 5.24.1-RC2
Description
The issue is related to errors in privilege management in the Perl interpreter, specifically with the handling of the included directory array ("@INC"). This could allow a local user to gain privileges via a Trojan horse module under the current working directory by exploiting the failure to properly remove period characters from the end of the includes directory array.
Recommendations
For Perl versions prior to 5.22.3-RC2, update to version 5.22.3-RC2 or later.
For Perl versions 5.24 prior to 5.24.1-RC2, update to version 5.24.1-RC2 or later.
As a temporary workaround, consider restricting access to the vulnerable modules under the current working directory to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Perl
Suse