PlRPC Perl module pre-auth remote code execution weak crypto

2014-01-09 / 2014-01-10
Risk: High
Local: No
Remote: Yes
CWE: CWE-94


Ogólna skala CVSS: 6.8/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

PlRPC is a Perl module that implements IDL-free RPCs. It is intended for cross-domain applications, but it fails to achieve that goal because it uses Storable, which is known to be insecure when deserializing (thawing) untrusted data. User name and password are transmitted using Storable, so code execution can happen before authentication. The cryptographic hook built into PlRPC is limited: there is no MAC, no reply protection, and there's just a symmetric group key shared by all users. It's not really PlRPC's fault, considering its age. https://rt.cpan.org/Public/Bug/Display.html?id=90474 https://bugzilla.redhat.com/show_bug.cgi?id=1030572 PlRPC mainly lives on because it is a dependency of DBD::Proxy, which is carried around by the DBI module. This might warrant two CVE assignments (one for the Storable-based code execution), and one for the weak crypto. This was first reported in 2013. The patches that exist just document the issues and are not real fixes (for Storable itself, there is only a documentation fix, so this has precedent). -- Florian Weimer / Red Hat Product Security Team

Referencje:

https://rt.cpan.org/Public/Bug/Display.html?id=90474
https://bugzilla.redhat.com/show_bug.cgi?id=1030572
http://seclists.org/oss-sec/2014/q1/56


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top