Perl UTF-8 Regular Expression Processing Remote Denial of Service Vulnerability

Bugtraq ID:	36812
Class:	Design Error
CVE:	CVE-2009-3626
Remote:	Yes
Local:	No
Published:	Oct 25 2009 12:00AM
Updated:	Feb 19 2010 08:51AM
Credit:	Mark Martinec
Vulnerable:	Larry Wall Perl 5.10.1 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 Activestate ActivePerl 5.10.1 build 1006 Activestate ActivePerl 5.10.1
Not Vulnerable:	Activestate ActivePerl 5.10.1 build 1007

Perl UTF-8 Regular Expression Processing Remote Denial of Service Vulnerability

Perl is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause an affected application to crash, denying service to legitimate users.

Perl 5.10.1 is vulnerable.

Perl UTF-8 Regular Expression Processing Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Perl UTF-8 Regular Expression Processing Remote Denial of Service Vulnerability

Solution:
The vendor has released a fix in the GIT repository. Please see the references for details.

Perl UTF-8 Regular Expression Processing Remote Denial of Service Vulnerability

References:

• #69973: Invalid and tainted utf-8 char crashes perl 5.10.1 in regexp evaluation (Perl)
  
• ActiveState announces ActivePerl 5.10.1 build 1007 and ActivePerl 5.8.9 build 82 (Activestate)
  
• disable non-unicode case insensitive trie matching (Perl)
  
• Perl Home Page (Perl)