Vulnerability CVE-2010-1168
Published: 2010-06-21   Modified: 2012-02-13

Description:
The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects, as demonstrated by the (a) DESTROY and (b) AUTOLOAD methods, related to "automagic methods."

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Rafael garcia-suarez -> SAFE 

 References:
http://blogs.perl.org/users/rafael_garcia-suarez/2010/03/new-safepm-fixes-security-hole.html
http://blogs.sun.com/security/entry/cve_2010_1168_vulnerability_in
http://cpansearch.perl.org/src/RGARCIA/Safe-2.27/Changes
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7424
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9807
http://securitytracker.com/id?1024062
http://www.mandriva.com/security/advisories?name=MDVSA-2010:115
http://www.mandriva.com/security/advisories?name=MDVSA-2010:116
http://www.openwall.com/lists/oss-security/2010/05/20/5
http://www.redhat.com/support/errata/RHSA-2010-0457.html
http://www.redhat.com/support/errata/RHSA-2010-0458.html
http://www.vupen.com/english/advisories/2010/3075
https://bugzilla.redhat.com/show_bug.cgi?id=576508
Copyright 2024, cxsecurity.com

 

Back to Top