PT-2017-7450 · Perl · Perl

Published 2017-02-07 · Updated 2020-07-15 · CVE-2015-8608

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Perl version 5.22

Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted input. Specifically, the VDir::MapPathA and VDir::MapPathW functions are vulnerable to an out-of-bounds read. The vulnerability can be triggered by a crafted drive letter or pInName argument.

Recommendations For Perl version 5.22, consider restricting the use of the VDir::MapPathA and VDir::MapPathW functions until a patch is available. As a temporary workaround, avoid using crafted drive letters or pInName arguments in these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2015-8608

Affected Products

Perl

References · 6

• 🔥 https://rt.perl.org/Public/Bug/Display.html?id=126755 · Exploit
• 🔥 https://packetstormsecurity.com/files/136649/Perl-5.22-VDir-MapPathA-W-Out-Of-Bounds-Reads-Buffer-Over-Reads.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8608 · Security Note
• https://oracle.com/security-alerts/cpujul2020.html · Note
• http://oracle.com/technetwork/security-advisory/cpujul2017-3236622.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8608 · Note