Novell NetWare Remote Perl Version Disclosure Vulnerability

Bugtraq ID:	5521
Class:	Unknown
CVE:	CVE-2002-1438
Remote:	Yes
Local:	No
Published:	Aug 20 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Credited to Rain Forrest Puppy <[email protected]>.
Vulnerable:	Novell Netware 6.0 SP1 Novell Netware 6.0 Novell Netware 5.1 SP4 Novell Netware 5.1
Not Vulnerable:

Novell NetWare Remote Perl Version Disclosure Vulnerability

A vulnerability has been reported in some versions of Novell NetWare. This issue exists when a web server uses Perl as a handler.

It is possible for an attacker to execute Perl with the '-v' parameter, resulting in the disclosure of the version of Perl in use. Full technical details are not currently available.

This issue has been reported in versions of NetWare using Perl 5.003. Reportedly, systems with Perl 5.6 installed are not vulnerable to this issue.

Novell NetWare Remote Perl Version Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Novell NetWare Remote Perl Version Disclosure Vulnerability

Solution:
An update is available:


Novell Netware 5.1 SP4

• Novell perl5002.exe
  Free registration is required.
  http://support.novell.com/servlet/filedownload/ftf/perl5002.exe/

Novell Netware 5.1

• Novell perl5002.exe
  Free registration is required.
  http://support.novell.com/servlet/filedownload/ftf/perl5002.exe/

Novell Netware 6.0

• Novell perl5002.exe
  Free registration is required.
  http://support.novell.com/servlet/filedownload/ftf/perl5002.exe/

Novell Netware 6.0 SP1

• Novell perl5002.exe
  Free registration is required.
  http://support.novell.com/servlet/filedownload/ftf/perl5002.exe/

Novell NetWare Remote Perl Version Disclosure Vulnerability

References:

• Security Alerts (Novell)