Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0522 advisory.

    - CVE-2008-1927 perl: double free on regular expressions with utf8 characters

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in Perl's regular expression engine. A specially crafted regular expression with Unicode characters could trigger a buffer overflow, causing Perl to crash, or possibly execute arbitrary code with the privileges of the user running Perl. (CVE-2008-1927)

Specially crafted regular expressions could crash perl.
(CVE-2008-1927)

Additionally problem in the CGI module was fixed that could result in an endless loop if uploads were cancelled.

I Security Issues

  a. OpenSSL Binaries Updated

  This fix updates the third-party OpenSSL library.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2007-3108 and CVE-2007-5135 to the issues   addressed by this update.

II Service Console rpm updates

  a. net-snmp Security update

  This fix upgrades the service console rpm for net-snmp to version   net-snmp-5.0.9-2.30E.24.
   Note: this update is relevant for ESX 3.0.3. The initial advisory   incorrectly stated that this update was present in ESX 3.0.3   when it was released on August 8, 2008.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2008-2292 and CVE-2008-0960 to the issues   addressed in net-snmp-5.0.9-2.30E.24.

  b. perl Security update

  This fix upgrades the service console rpm for perl to version   perl-5.8.0-98.EL3.

  Note: this update is relevant for ESX 3.0.3. The initial advisory   incorrectly stated that this update was present in ESX 3.0.3   when it was released on August 8, 2008.

  The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the name CVE-2008-1927 to the issue addressed in   perl-5.8.0-98.EL3.

Specially crafted regular expressions could crash perl (CVE-2008-1927).

Insufficient symlink checks in the File::Path could result in wrong file permissions (CVE-2008-2827).

Additionally problem in the CGI module was fixed that could result in an endless loop if uploads were cancelled.

Jonathan Smith discovered that the Archive::Tar Perl module did not correctly handle symlinks when extracting archives. If a user or automated system were tricked into opening a specially crafted tar file, a remote attacker could over-write arbitrary files.
(CVE-2007-4829)

Tavis Ormandy and Will Drewry discovered that Perl did not correctly handle certain utf8 characters in regular expressions. If a user or automated system were tricked into using a specially crafted expression, a remote attacker could crash the application, leading to a denial of service. Ubuntu 8.10 was not affected by this issue.
(CVE-2008-1927)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could create arbitrary setuid binaries. Ubuntu 6.06 and 8.10 were not affected by this issue. (CVE-2008-5302)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could delete arbitrary files. Ubuntu 6.06 was not affected by this issue. (CVE-2008-5303).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A double free vulnerability in Perl 5.8.8 and earlier versions, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters.

The updated packages have been patched to prevent this.

USN-700-1 fixed vulnerabilities in Perl. Due to problems with the Ubuntu 8.04 build, some Perl .ph files were missing from the resulting update. This update fixes the problem. We apologize for the inconvenience.

Jonathan Smith discovered that the Archive::Tar Perl module did not correctly handle symlinks when extracting archives. If a user or automated system were tricked into opening a specially crafted tar file, a remote attacker could over-write arbitrary files.
(CVE-2007-4829)

Tavis Ormandy and Will Drewry discovered that Perl did not correctly handle certain utf8 characters in regular expressions. If a user or automated system were tricked into using a specially crafted expression, a remote attacker could crash the application, leading to a denial of service.
Ubuntu 8.10 was not affected by this issue. (CVE-2008-1927)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could create arbitrary setuid binaries. Ubuntu 6.06 and 8.10 were not affected by this issue. (CVE-2008-5302)

A race condition was discovered in the File::Path Perl module's rmtree function. If a local attacker successfully raced another user's call of rmtree, they could delete arbitrary files. Ubuntu 6.06 was not affected by this issue.
(CVE-2008-5303).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

Specially crafted regular expressions could crash perl (CVE-2008-1927).

Additionally problem in the CGI module was fixed that could result in an endless loop if uploads were cancelled.

Updated perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

A flaw was found in Perl's regular expression engine. A specially crafted regular expression with Unicode characters could trigger a buffer overflow, causing Perl to crash, or possibly execute arbitrary code with the privileges of the user running Perl. (CVE-2008-1927)

Users of perl are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.

The remote host is affected by the vulnerability described in GLSA-200805-17 (Perl: Execution of arbitrary code)

    Tavis Ormandy and Will Drewry of the Google Security Team have reported     a double free vulnerability when processing a crafted regular     expression containing UTF-8 characters.
  Impact :

    A remote attacker could possibly exploit this vulnerability to execute     arbitrary code or cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

- Tue Apr 29 2008 Marcela Maslanova <mmaslano at     redhat.com> - 4:5.8.8-29

    - CVE-2008-1927 buffer overflow, when unicode character       is used.

    - Thu Jan 31 2008 Tom 'spot' Callaway <tcallawa at       redhat.com> - 4:5.8.8-28

    - create /usr/lib/perl5/vendor_perl/5.8.8/auto and own       it in base perl (resolves bugzilla 214580)

  - Mon Nov 26 2007 Tom 'spot' Callaway <tcallawa at     redhat.com> - 4:5.8.8-27

    - break dep loop, fix bugzilla 397881

    - Mon Nov 12 2007 Tom 'spot' Callaway <tcallawa at       redhat.com> - 4:5.8.8-26

    - fix for CVE-2007-5116

    - Thu Oct 25 2007 Tom 'spot' Callaway <tcallawa at       redhat.com> - 4:5.8.8-25

    - patch from perl bug 24254, fix for RH bz 114271

    - Mon Oct 1 2007 Tom 'spot' Callaway <tcallawa at       redhat.com> - 4:5.8.8-24

    - update DB_File to 1.815

    - Sat Aug 18 2007 Stepan Kasal <skasal at redhat.com> -       4:5.8.8-23

    - Remove unnnecessary parens from the License tags.

    - Sat Aug 18 2007 Stepan Kasal <skasal at redhat.com> -       4:5.8.8-22

    - Fix the License: tags.

    - Fri Aug 17 2007 Stepan Kasal <skasal at redhat.com> -       4:5.8.8-21

    - Apply patch to skip hostname tests, since hostname       lookup isn't available in Fedora buildroots by design.

  - Fri Aug 17 2007 Stepan Kasal <skasal at redhat.com> -     4:5.8.8-20

    - perl rpm requires the corresponding version of       perl-libs rpm

    - Resolves: rhbz#240540

    - Fri Jun 22 2007 Robin Norwood <rnorwood at redhat.com>
      - 4:5.8.8-19

    - Resolves: rhbz#196836

    - Apply upstream patch #28775, which fixes an issue       where reblessing overloaded objects incurs significant       performance penalty

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Apr 29 2008 Marcela Maslanova <mmaslano at     redhat.com> - 4:5.8.8-39

    - perl-5.8.8-CVE-2008-1927.patch - buffer overflow, when       using unicode characters in regexp

  - Wed Mar 19 2008 Marcela Maslanova <mmaslano at     redhat.com> - 4:5.8.8-38

    - 434865 upgrade Test::Simple

    - turn off test on loading Dummy in More.t, can't find       module (path problem?)

    - 238581: careless use of gethostbyname() in Socket.xs

    - Thu Mar 13 2008 Marcela Maslanova <mmaslano at       redhat.com> - 4:5.8.8-37

    - update CGI, because of broken upload method #431774

    - Fri Feb 29 2008 Marcela Maslanova <mmaslano at       redhat.com> - 4:5.8.8-36

    - remove conflicts perl-File-Temp. Use obsoletes.

    - Fri Feb 29 2008 Marcela Maslanova <mmaslano at       redhat.com> - 4:5.8.8-35

    - upgrade Scalar::Util - possible fix for many bugs.
      Packages dependent on this module could work even with       use of CPAN modules.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It has been discovered that the Perl interpreter may encounter a buffer overflow condition when compiling certain regular expressions containing Unicode characters. This also happens if the offending characters are contained in a variable reference protected by the \Q...\E quoting construct. When encountering this condition, the Perl interpreter typically crashes, but arbitrary code execution cannot be ruled out.

ID	Name	Product	Family	Severity
67707	Oracle Linux 5 : perl (ELSA-2008-0522)	Nessus	Oracle Linux Local Security Checks	high
60421	Scientific Linux Security Update : perl on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41225	SuSE9 Security Update : Perl (YOU Patch Number 12208)	Nessus	SuSE Local Security Checks	medium
40381	VMSA-2008-0013 : Updated ESX packages for OpenSSL, net-snmp, perl	Nessus	VMware ESX Local Security Checks	critical
40104	openSUSE Security Update : perl (perl-101)	Nessus	SuSE Local Security Checks	medium
37888	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libarchive-tar-perl, perl vulnerabilities (USN-700-1)	Nessus	Ubuntu Local Security Checks	medium
37868	Mandriva Linux Security Advisory : perl (MDVSA-2008:100)	Nessus	Mandriva Local Security Checks	medium
37746	Ubuntu 8.04 LTS : perl regression (USN-700-2)	Nessus	Ubuntu Local Security Checks	medium
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
34041	SuSE 10 Security Update : Perl (ZYPP Patch Number 5444)	Nessus	SuSE Local Security Checks	medium
34040	openSUSE 10 Security Update : perl (perl-5443)	Nessus	SuSE Local Security Checks	medium
33171	CentOS 3 / 4 / 5 : perl (CESA-2008:0522)	Nessus	CentOS Local Security Checks	medium
33155	RHEL 3 / 4 / 5 : perl (RHSA-2008:0522)	Nessus	Red Hat Local Security Checks	medium
32415	GLSA-200805-17 : Perl: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
32105	Fedora 7 : perl-5.8.8-29.fc7 (2008-3399)	Nessus	Fedora Local Security Checks	medium
32103	Fedora 8 : perl-5.8.8-39.fc8 (2008-3392)	Nessus	Fedora Local Security Checks	medium
32057	Debian DSA-1556-2 : perl - heap buffer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2008-1927

high

Tenable Plugins

high

medium

medium

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium