Perl 'win32_stat' function Remote Buffer Overflow Vulnerability
BID:10050
Info
Perl 'win32_stat' function Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 10050 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0377 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 05 2004 12:00AM |
| Updated: | Jul 12 2009 04:06AM |
| Credit: | Discovery is credited to Greg MacManus. |
| Vulnerable: |
Larry Wall Perl 5.8.3 Larry Wall Perl 5.8 Larry Wall Perl 5.6.1 Larry Wall Perl 5.6 Larry Wall Perl 5.0 05_003 Larry Wall Perl 5.0 05 Larry Wall Perl 5.0 04_05 Larry Wall Perl 5.0 04 Larry Wall Perl 5.0 03 Activestate ActivePerl 5.9 dev Activestate ActivePerl 5.8.3 Activestate ActivePerl 5.8.1 Activestate ActivePerl 5.8 Activestate ActivePerl 5.7.3 Activestate ActivePerl 5.7.2 Activestate ActivePerl 5.7.1 Activestate ActivePerl 5.6.3 Activestate ActivePerl 5.6.2 Activestate ActivePerl 5.6.1 .630 Activestate ActivePerl 5.6.1 |
| Not Vulnerable: | |
Discussion
Perl 'win32_stat' function Remote Buffer Overflow Vulnerability
It has been reported that a remote buffer overflow condition in the win32 wrapper to the stat() routine employed by Perl could allow an attacker to cause a denial of service condition or execute arbitrary code. The problem exists in the 'win32_stat' function due to insufficient boundary checking.
Perl versions 5.8.3 and prior for the Windows platforms are reported to be vulnerable to this issue.
It has been reported that a remote buffer overflow condition in the win32 wrapper to the stat() routine employed by Perl could allow an attacker to cause a denial of service condition or execute arbitrary code. The problem exists in the 'win32_stat' function due to insufficient boundary checking.
Perl versions 5.8.3 and prior for the Windows platforms are reported to be vulnerable to this issue.
Exploit / POC
Perl 'win32_stat' function Remote Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Perl 'win32_stat' function Remote Buffer Overflow Vulnerability
Solution:
Patches are availabe from Activestate for Perl 5.9 development branch and Perl 5.8 maintenance branch.
Activestate ActivePerl 5.8
Activestate ActivePerl 5.8.1
Activestate ActivePerl 5.8.3
Activestate ActivePerl 5.9 dev
Solution:
Patches are availabe from Activestate for Perl 5.9 development branch and Perl 5.8 maintenance branch.
Activestate ActivePerl 5.8
-
Activestate Patch 22552
http://public.activestate.com/cgi-bin/perlbrowse?patch=22552
Activestate ActivePerl 5.8.1
-
Activestate Patch 22552
http://public.activestate.com/cgi-bin/perlbrowse?patch=22552
Activestate ActivePerl 5.8.3
-
Activestate Patch 22552
http://public.activestate.com/cgi-bin/perlbrowse?patch=22552
Activestate ActivePerl 5.9 dev
-
Activestate Patch 22466
http://public.activestate.com/cgi-bin/perlbrowse?patch=22466