CVE-2016-2381 - 漏洞详情

CVE-2016-2381 (CNNVD-201603-004)

HIGH

中文标题:

Perl 输入验证错误漏洞

英文标题:

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child pro...

CVSS分数: 7.5

发布时间: 2016-04-08 15:00:00

漏洞类型: 输入验证错误

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Perl是美国程序员拉里-沃尔（Larry Wall）所研发的一种免费且功能强大的跨平台编程语言。 Perl中存在安全漏洞。攻击者可借助envp中重复的环境变量利用该漏洞绕过子进程中的taint保护机制。

英文描述:

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CWE类型:

CWE-20

受影响产品

厂商	产品	版本	版本范围	平台	CPE
perl	perl	*	-	-	`cpe:2.3:a:perl:perl::::::::`
debian	debian_linux	7.0	-	-	`cpe:2.3:o:debian:debian_linux:7.0:::::::*`
debian	debian_linux	8.0	-	-	`cpe:2.3:o:debian:debian_linux:8.0:::::::*`
oracle	communications_billing_and_revenue_management	7.5	-	-	`cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:::::::*`
oracle	configuration_manager	*	-	-	`cpe:2.3:a:oracle:configuration_manager::::::::`
oracle	configuration_manager	12.1.2.0.6	-	-	`cpe:2.3:a:oracle:configuration_manager:12.1.2.0.6:::::::*`
oracle	database_server	11.2.0.4	-	-	`cpe:2.3:a:oracle:database_server:11.2.0.4:::::::*`
oracle	database_server	12.1.0.2	-	-	`cpe:2.3:a:oracle:database_server:12.1.0.2:::::::*`
oracle	database_server	12.2.0.1	-	-	`cpe:2.3:a:oracle:database_server:12.2.0.1:::::::*`
oracle	database_server	18c	-	-	`cpe:2.3:a:oracle:database_server:18c:::::::*`
oracle	database_server	19c	-	-	`cpe:2.3:a:oracle:database_server:19c:::::::*`
oracle	enterprise_manager_base_platform	13.2.0.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:::::::*`
oracle	enterprise_manager_base_platform	13.3.0.0.0	-	-	`cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:::::::*`
oracle	timesten_in-memory_database	*	-	-	`cpe:2.3:a:oracle:timesten_in-memory_database::::::::`
oracle	solaris	11.3	-	-	`cpe:2.3:o:oracle:solaris:11.3:::::::*`
opensuse	opensuse	13.2	-	-	`cpe:2.3:o:opensuse:opensuse:13.2:::::::*`
canonical	ubuntu_linux	12.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::`
canonical	ubuntu_linux	14.04	-	-	`cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::`
canonical	ubuntu_linux	15.10	-	-	`cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

GLSA-201701-75 vendor-advisory
cve.org

访问

DSA-3501 vendor-advisory
cve.org

访问

[porters] 20160301 CVE-2016-2381: duplicate environment variables mailing-list
cve.org

访问

USN-2916-1 vendor-advisory
cve.org

访问

83802 vdb-entry
cve.org

访问

openSUSE-SU-2016:0881 vendor-advisory
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问