Safe.PM执行不安全代码漏洞

漏洞信息详情

Safe.PM执行不安全代码漏洞

• CNNVD编号：CNNVD-200212-019
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2002-1323
  
• 漏洞类型：
  
  
  访问验证错误
  
• 发布时间：
  
  2002-12-11
  
• 威胁类型：
  
  
  本地
  
• 更新时间：
  
  2005-05-17
  
• 厂        商：
  
  sgi
• 漏洞来源：
  Discovery of this …

用于Perl 5.8.0及其早期版本的Safe.pm 2.0.7及其早期版本存在漏洞。攻击者可以利用该漏洞突破(1)Safe：：reval或(2)Safe：：rdo使用重新定义@_变量中的安全隔间
，该变量在两次成功的调用间隔内不被重置。

See the referenced vendor advisories for additional details.
NOTE: Fixes are available.
Sun Solaris 9

• Sun 119449-01
  
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-119449-01-1

Sun Solaris 9_x86

• Sun 119450-01
  
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-119450-01-1

Sun Solaris 8_x86

• Sun 122092-01
  
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21
  -122092-01-1

Safe.pm Safe.pm 2.0 7

• Debian libperl-dev_5.6.1-8.2_alpha.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_alpha.deb
• Debian libperl-dev_5.6.1-8.2_arm.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_arm.deb
• Debian libperl-dev_5.6.1-8.2_hppa.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_hppa.deb
• Debian libperl-dev_5.6.1-8.2_i386.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_i386.deb
• Debian libperl-dev_5.6.1-8.2_ia64.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_ia64.deb
• Debian libperl-dev_5.6.1-8.2_m68k.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_m68k.deb
• Debian libperl-dev_5.6.1-8.2_mips.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_mips.deb
• Debian libperl-dev_5.6.1-8.2_mipsel.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_mipsel.deb
• Debian libperl-dev_5.6.1-8.2_powerpc.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_powerpc.deb
• Debian libperl-dev_5.6.1-8.2_s390.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_s390.deb
• Debian libperl-dev_5.6.1-8.2_sparc.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-
  8.2_sparc.deb
• Debian libperl5.6_5.6.1-8.2_alpha.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_alpha.deb
• Debian libperl5.6_5.6.1-8.2_arm.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_arm.deb
• Debian libperl5.6_5.6.1-8.2_hppa.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_hppa.deb
• Debian libperl5.6_5.6.1-8.2_i386.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_i386.deb
• Debian libperl5.6_5.6.1-8.2_ia64.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_ia64.deb
• Debian libperl5.6_5.6.1-8.2_m68k.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_m68k.deb
• Debian libperl5.6_5.6.1-8.2_mipsel.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_mipsel.deb
• Debian libperl5.6_5.6.1-8.2_powerpc.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_powerpc.deb
• Debian libperl5.6_5.6.1-8.2_s390.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_s390.deb
• Debian libperl5.6_5.6.1-8.2_sparc.debDebian GNU/Linux 3.0 alias woody
  
  http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8
  .2_sparc.deb
• Debian perl-5.004-base_5.004.05-6.2_alpha.deb
  
  http://security.debian.org/pool/updates/main/p/perl-5.004/perl-5.004-b
  ase_5.004.05-6.2_alpha.deb
• Debian perl-5.004-base_5.004.05-6.2_arm.deb
  
  http://security.debian.org/pool/updates/main/p/perl-5.004/perl-5.004-b
  ase_5.004.05-6.2_arm.deb
• Debian perl-5.004-base_5.004.05-6.2_i386.deb
  
  http://security.debian.org/pool/updates/main/p/perl-5.004/perl-5.004-b
  ase_5.004.05-6.2_i386.deb
• Debian perl-5.004-base_5.004.05-6.2_m68k.deb
  
  http://security.debian.org/pool/updates/main/p/perl-5.004/perl-5.004-b
  ase_5.004.05-6.2_m68k.deb
• Debian perl-5.004-base_5.004.05-6.2_p

来源: BID
名称: 6111
链接:http://www.securityfocus.com/bid/6111

来源: DEBIAN
名称: DSA-208
链接:http://www.debian.org/security/2002/dsa-208

来源: use.perl.org
链接:http://use.perl.org/articles/02/10/06/1118222.shtml?tid=5

来源: XF
名称: safe-pm-bypass-restrictions(10574)
链接:http://www.iss.net/security_center/static/10574.php

来源: BUGTRAQ
名称: 20021219 TSLSA-2002-0087 – perl
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=104033126305252&w=2

来源: bugs6.perl.org
链接:http://bugs6.perl.org/rt2/Ticket/Display.html?id=17744

来源: REDHAT
名称: RHSA-2003:257
链接:http://www.redhat.com/support/errata/RHSA-2003-257.html

来源: REDHAT
名称: RHSA-2003:256
链接:http://www.redhat.com/support/errata/RHSA-2003-256.html

来源: OSVDB
名称: 3814
链接:http://www.osvdb.org/3814

来源: OSVDB
名称: 2183
链接:http://www.osvdb.org/2183

来源: BUGTRAQ
名称: 20021220 GLSA: perl
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=104040175522502&w=2

来源: BUGTRAQ
名称: 20021216 [OpenPKG-SA-2002.014] OpenPKG Security Advisory (perl)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=104005919814869&w=2

来源: VULNWATCH
名称: 20021105 Perl Safe.pm compartment reuse vuln
链接:http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0061.html

来源: SGI
名称: 20030606-01-A
链接:ftp://patches.sgi.com/support/free/security/advisories/20030606-01-A

来源: SCO
名称: SCOSA-2004.1
链接:ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.1/SCOSA-2004.1.txt

来源: CALDERA
名称: CSSA-2004-007.0
链接:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2004-007.0.txt

来源: US Government Resource: oval:org.mitre.oval:def:1160
名称: oval:org.mitre.oval:def:1160
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1160