388319 – dev-lang/perl-5.x "Digest->new()" Code Injection Vulnerability (CVE-2011-3597)

Bug 388319 - dev-lang/perl-5.x "Digest->new()" Code Injection Vulnerability (CVE-2011-3597)

Summary: dev-lang/perl-5.x "Digest->new()" Code Injection Vulnerability (CVE-2011-3597)

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal major (vote)
Assignee:	Gentoo Security

URL:	http://secunia.com/advisories/46299/
Whiteboard:	B1 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2011-10-24 10:18 UTC by Michael Harrison
Modified:	2014-07-09 21:43 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Michael Harrison 2011-10-24 10:18:06 UTC

+++ This bug was initially created as a clone of Bug #385487 +++

From secunia security advisory at $URL:

Description:
The vulnerability is caused due to the "Digest->new()" function not properly sanitising input before using it in an "eval()" call, which can be exploited to inject and execute arbitrary Perl code.

Comment 1 Tim Sammut (RETIRED) gentoo-dev

2011-10-25 19:14:02 UTC

Michael, is this different than in bug #385487?

Comment 2 Michael Harrison 2011-10-26 08:07:49 UTC

Yes Tim,
This is applicable to Perl 5.x instead of the actual Digest module <1.17
I added the wrong $URL for all product versions instead of the Secunia Adv. which I just updated.  For clarity, the original bug was as follows:
http://secunia.com/advisories/46279/

The new advisory for Perl 5 is as follows:
http://secunia.com/advisories/46299/

IMO still a bit confusing because the commit applies to the Digest version, but a3li said to go ahead and clone.

Comment 3 Alex Legler (RETIRED) archtester

2011-10-26 09:53:28 UTC

(In reply to comment #2)
> IMO still a bit confusing because the commit applies to the Digest version, but
> a3li said to go ahead and clone.

Perl seems to bundle some CPAN packages, so new package -> new bug

Comment 4 Mikle Kolyada (RETIRED) archtester

2014-07-09 21:43:34 UTC

CVE says:
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
5.17 was released starting with perl v5.15.4. Currently there are no affected perl distros in the tree at all. This bug is old. I prefer to close it as [nogla]