[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9bf069f5-9476-45b0-a89b-6b5dbf1235ee@oracle.com>
Date: Thu, 30 Nov 2023 16:42:04 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: New CVEs and security fix releases for perl
[While https://github.com/Perl/perl5/blob/blead/pod/perlsecpolicy.pod states
they will send security advisories to this list, I haven't seen any come
through yet for these issues. -alan-]
https://metacpan.org/release/PEVANS/perl-5.38.1/view/pod/perldelta.pod lists
two new CVE's:
--------------------------------------------------------------------------------
CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property
This vulnerability was reported directly to the Perl security team by
Nathan Mills the.true.nathan.mills@...il.com.
A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can
cause a one-byte attacker controlled buffer overflow in a heap allocated buffer.
--------------------------------------------------------------------------------
CVE-2023-47039 - Perl for Windows binary hijacking vulnerability
This vulnerability was reported to the Intel Product Security Incident Response
Team (PSIRT) by GitHub user ycdxsb
https://github.com/ycdxsb/WindowsPrivilegeEscalation.
PSIRT then reported it to the Perl security team.
Perl for Windows relies on the system path environment variable to find the
shell (cmd.exe). When running an executable which uses Windows Perl interpreter,
Perl attempts to find and execute cmd.exe within the operating system. However,
due to path search order issues, Perl initially looks for cmd.exe in the current
working directory.
An attacker with limited privileges can exploit this behavior by placing cmd.exe
in locations with weak permissions, such as C:\ProgramData. By doing so, when an
administrator attempts to use this executable from these compromised locations,
arbitrary code can be executed.
--------------------------------------------------------------------------------
The 5.34.2, 5.36.2 and 5.38.1 releases were issued with fixes for these issues.
However, there were issues with those releases, as noted in the email at
https://www.nntp.perl.org/group/perl.perl5.porters/2023/11/msg267365.html
and thus versions 5.34.3, 5.36.3 and 5.38.2 were released to fix those issues:
https://www.nntp.perl.org/group/perl.perl5.porters/2023/11/msg267400.html
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
