CVE-2010-1168

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects, as demonstrated by the (a) DESTROY and (b) AUTOLOAD methods, related to "automagic methods."

References

http://blogs.perl.org/users/rafael_garcia-suarez/2010/03/new-safepm-fixes-security-hole.html

http://blogs.sun.com/security/entry/cve_2010_1168_vulnerability_in

http://cpansearch.perl.org/src/RGARCIA/Safe-2.27/Changes

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735

http://secunia.com/advisories/40049

http://secunia.com/advisories/40052

http://secunia.com/advisories/42402

http://securitytracker.com/id?1024062

http://www.mandriva.com/security/advisories?name=MDVSA-2010:115

http://www.mandriva.com/security/advisories?name=MDVSA-2010:116

http://www.openwall.com/lists/oss-security/2010/05/20/5

http://www.redhat.com/support/errata/RHSA-2010-0457.html

http://www.redhat.com/support/errata/RHSA-2010-0458.html

http://www.vupen.com/english/advisories/2010/3075

https://bugzilla.redhat.com/show_bug.cgi?id=576508

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7424

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9807

Details

Source: MITRE

Published: 2010-06-21

Updated: 2017-09-19

Type: CWE-264

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

Tenable Plugins

View all (30 total)

IDNameProductFamilySeverity
108090Solaris 10 (x86) : 146773-01NessusSolaris Local Security Checks
high
107597Solaris 10 (sparc) : 146769-01NessusSolaris Local Security Checks
high
89741VMware ESX Multiple Vulnerabilities (VMSA-2010-0013) (remote check)NessusVMware ESX Local Security Checks
high
68048Oracle Linux 5 : perl (ELSA-2010-0458)NessusOracle Linux Local Security Checks
high
68047Oracle Linux 3 / 4 : perl (ELSA-2010-0457)NessusOracle Linux Local Security Checks
high
68044Oracle Linux 5 : postgresql (ELSA-2010-0429)NessusOracle Linux Local Security Checks
high
68043Oracle Linux 4 : postgresql (ELSA-2010-0428)NessusOracle Linux Local Security Checks
high
60801Scientific Linux Security Update : perl on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
high
60800Scientific Linux Security Update : perl on SL3.x, SL4.x i386/x86_64NessusScientific Linux Local Security Checks
high
56905GLSA-201111-09 : Perl Safe module: Arbitrary Perl code injectionNessusGentoo Local Security Checks
high
55090Ubuntu 6.06 LTS / 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : perl vulnerabilities (USN-1129-1)NessusUbuntu Local Security Checks
high
50956SuSE 11 / 11.1 Security Update : Perl (SAT Patch Numbers 2833 / 2834)NessusSuSE Local Security Checks
high
49914SuSE 10 Security Update : Perl (ZYPP Patch Number 7108)NessusSuSE Local Security Checks
high
49085VMSA-2010-0013 : VMware ESX third-party updates for Service ConsoleNessusVMware ESX Local Security Checks
high
48429SuSE9 Security Update : Perl (YOU Patch Number 12628)NessusSuSE Local Security Checks
high
48373openSUSE Security Update : perl (openSUSE-SU-2010:0518-1)NessusSuSE Local Security Checks
high
48372openSUSE Security Update : perl (openSUSE-SU-2010:0519-1)NessusSuSE Local Security Checks
high
48324Fedora 12 : perl-5.10.0-91.fc12 (2010-11340)NessusFedora Local Security Checks
high
48227Fedora 13 : perl-5.10.1-116.fc13 (2010-11323)NessusFedora Local Security Checks
high
46878Mandriva Linux Security Advisory : perl (MDVSA-2010:116)NessusMandriva Local Security Checks
high
46877Mandriva Linux Security Advisory : perl (MDVSA-2010:115)NessusMandriva Local Security Checks
high
46874CentOS 5 : perl (CESA-2010:0458)NessusCentOS Local Security Checks
high
46834RHEL 5 : perl (RHSA-2010:0458)NessusRed Hat Local Security Checks
high
46833RHEL 3 / 4 : perl (RHSA-2010:0457)NessusRed Hat Local Security Checks
high
46761CentOS 5 : postgresql (CESA-2010:0429)NessusCentOS Local Security Checks
high
46710Debian DSA-2051-1 : postgresql-8.3 - several vulnerabilitiesNessusDebian Local Security Checks
high
46700Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerabilities (USN-942-1)NessusUbuntu Local Security Checks
high
46696CentOS 4 : postgresql (CESA-2010:0428)NessusCentOS Local Security Checks
high
46683RHEL 5 : postgresql (RHSA-2010:0429)NessusRed Hat Local Security Checks
high
46682RHEL 4 : postgresql (RHSA-2010:0428)NessusRed Hat Local Security Checks
high