Executive Summary

Informations
Name MDVSA-2012:009 First vendor Publication 2012-01-18
Vendor Mandriva Last vendor Modification 2012-01-18
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability has been found and corrected in perl:

Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor (CVE-2011-3597).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2012:009

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:19446
 
Oval ID: oval:org.mitre.oval:def:19446
Title: Perl Digest Module Code Injection Vulnerability
Description: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Family: unix Class: vulnerability
Reference(s): CVE-2011-3597
 Version: 5
Platform(s): IBM AIX 5.3
IBM AIX 6.1
IBM AIX 7.1
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20560
 
Oval ID: oval:org.mitre.oval:def:20560
Title: VMware vSphere and vCOps updates to third party libraries
Description: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Family: unix Class: vulnerability
Reference(s): CVE-2011-3597
 Version: 4
Platform(s): VMWare ESX Server 4.1
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21725
 
Oval ID: oval:org.mitre.oval:def:21725
Title: RHSA-2011:1797: perl security update (Moderate)
Description: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Family: unix Class: patch
Reference(s): RHSA-2011:1797-01
CESA-2011:1797
CVE-2010-2761
CVE-2010-4410
CVE-2011-3597
 Version: 42
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): perl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22078
 
Oval ID: oval:org.mitre.oval:def:22078
Title: RHSA-2011:1424: perl security update (Moderate)
Description: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Family: unix Class: patch
Reference(s): RHSA-2011:1424-01
CVE-2011-2939
CVE-2011-3597
 Version: 29
Platform(s): Red Hat Enterprise Linux 6
 Product(s): perl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23231
 
Oval ID: oval:org.mitre.oval:def:23231
Title: ELSA-2011:1797: perl security update (Moderate)
Description: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Family: unix Class: patch
Reference(s): ELSA-2011:1797-01
CVE-2010-2761
CVE-2010-4410
CVE-2011-3597
 Version: 17
Platform(s): Oracle Linux 5
 Product(s): perl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23778
 
Oval ID: oval:org.mitre.oval:def:23778
Title: ELSA-2011:1424: perl security update (Moderate)
Description: Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Family: unix Class: patch
Reference(s): ELSA-2011:1424-01
CVE-2011-2939
CVE-2011-3597
 Version: 13
Platform(s): Oracle Linux 6
 Product(s): perl
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27753
 
Oval ID: oval:org.mitre.oval:def:27753
Title: DEPRECATED: ELSA-2011-1424 -- perl security update (moderate)
Description: [4:5.10.1-119.1] - 731246 (CVE-2011-2939)CVE-2011-2939 heap overflow - decoding Unicode string - 743010 - perl: code injection vulnerability in Digest->new() - Resolves: rhbz#743090, rhbz#743092
Family: unix Class: patch
Reference(s): ELSA-2011-1424
CVE-2011-2939
CVE-2011-3597
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): perl
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 17

OpenVAS Exploits

Date Description
2012-12-04 Name : Ubuntu Update for perl USN-1643-1
File : nvt/gb_ubuntu_USN_1643_1.nasl
2012-08-31 Name : VMSA-2012-0013 VMware vSphere and vCOps updates to third party libraries.
File : nvt/gb_VMSA-2012-0013.nasl
2012-07-30 Name : CentOS Update for perl CESA-2011:1797 centos4 x86_64
File : nvt/gb_CESA-2011_1797_perl_centos4_x86_64.nasl
2012-07-30 Name : CentOS Update for perl CESA-2011:1797 centos5 x86_64
File : nvt/gb_CESA-2011_1797_perl_centos5_x86_64.nasl
2012-07-09 Name : RedHat Update for perl RHSA-2011:1424-01
File : nvt/gb_RHSA-2011_1424-01_perl.nasl
2012-01-20 Name : Mandriva Update for perl MDVSA-2012:008 (perl)
File : nvt/gb_mandriva_MDVSA_2012_008.nasl
2012-01-20 Name : Mandriva Update for perl MDVSA-2012:009 (perl)
File : nvt/gb_mandriva_MDVSA_2012_009.nasl
2012-01-17 Name : Strawberry Perl Modules Multiple Vulnerabilities (Windows)
File : nvt/gb_perl_modules_mult_vuln_win.nasl
2011-12-12 Name : CentOS Update for perl CESA-2011:1797 centos4 i386
File : nvt/gb_CESA-2011_1797_perl_centos4_i386.nasl
2011-12-12 Name : CentOS Update for perl CESA-2011:1797 centos5 i386
File : nvt/gb_CESA-2011_1797_perl_centos5_i386.nasl
2011-12-09 Name : RedHat Update for perl RHSA-2011:1797-01
File : nvt/gb_RHSA-2011_1797-01_perl.nasl
2011-11-03 Name : Fedora Update for perl FEDORA-2011-13874
File : nvt/gb_fedora_2011_13874_perl_fc14.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
75990 Digest Module for Perl Digest->new() Function eval() Call Remote Perl Code...

Information Assurance Vulnerability Management (IAVM)

Date Description
2012-09-27 IAVM : 2012-A-0153 - Multiple Vulnerabilities in VMware ESX 4.0 and ESXi 4.0
Severity : Category I - VMSKEY : V0033884
2012-09-13 IAVM : 2012-A-0148 - Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1
Severity : Category I - VMSKEY : V0033794

Nessus® Vulnerability Scanner

Date Description
2016-02-29 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2012-0013_remote.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_perl-58_20131017_2.nasl - Type : ACT_GATHER_INFO
2014-01-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201401-33.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2011-19.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-1424.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-1797.nasl - Type : ACT_GATHER_INFO
2013-01-30 Name : The remote AIX host is missing a security patch.
File : aix_IV10197.nasl - Type : ACT_GATHER_INFO
2012-11-30 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1643-1.nasl - Type : ACT_GATHER_INFO
2012-08-31 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2012-0013.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20111103_perl_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20111208_perl_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-01-19 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-008.nasl - Type : ACT_GATHER_INFO
2011-12-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2011-1797.nasl - Type : ACT_GATHER_INFO
2011-12-09 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-1797.nasl - Type : ACT_GATHER_INFO
2011-11-04 Name : The remote host is missing the patch for the advisory RHSA-2011-1424
File : redhat-RHSA-2011-1424.nasl - Type : ACT_GATHER_INFO
2011-11-03 Name : The remote Fedora host is missing a security update.
File : fedora_2011-13874.nasl - Type : ACT_GATHER_INFO