CVE-2011-1487

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 8.4%

from disclosure to weapon0 days

Published on NVDApr 11

1st PoCMar 30

exploitation probability

8.4%top 6% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35554

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057891.html http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057971.html http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://openwall.com/lists/oss-security/2011/04/01/3 http://openwall.com/lists/oss-security/2011/04/04/35 http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99 http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336 https://bugzilla.redhat.com/show_bug.cgi?id=692844 https://bugzilla.redhat.com/show_bug.cgi?id=692898 http://secunia.com/advisories/43921 http://secunia.com/advisories/44168 https://exchange.xforce.ibmcloud.com/vulnerabilities/66528