PT-2019-6560 · Perl · Libpoe-Component-Irc-Perl

Vincent Danen · Published 2019-11-12 · Updated 2019-11-15 · CVE-2010-3438

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libpoe-component-irc-perl versions prior to 6.32

Description The issue allows execution of arbitrary IRC commands by passing a specially crafted argument to the 'privmsg' handler, potentially causing the client to disconnect from the server. This can be achieved by including carriage returns and line feeds in the argument, such as "some textrQUIT".

Recommendations For versions prior to 6.32, consider removing or properly handling carriage returns and line feeds in arguments passed to the 'privmsg' handler to prevent arbitrary IRC command execution. As a temporary workaround, restrict the use of the 'privmsg' handler until a proper fix is applied.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2010-3438

Affected Products

Libpoe-Component-Irc-Perl

References · 6

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581194 · Patch
• https://security-tracker.debian.org/tracker/CVE-2010-3438 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3438 · Patch
• https://osv.dev/vulnerability/CVE-2010-3438 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3438 · Security Note