The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression,     which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in     an RFC 2822 address. (CVE-2014-0477)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update fixes a denial of service vulnerability when parsing an empty quoted string (CVE-2014-0477)

Updated perl-Email-Address package fixes security vulnerability :

The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address (CVE-2014-0477).

The Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to backtracking into the phrase (CVE-2014-4720).

Update to 1.905 to fix CVE-2014-0477.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bastian Blank reported a denial of service vulnerability in Email::Address, a Perl module for RFC 2822 address parsing and creation. Email::Address::parse used significant time on parsing empty quoted strings. A remote attacker able to supply specifically crafted input to an application using Email::Address for parsing, could use this flaw to mount a denial of service attack against the application.

ID	Name	Product	Family	Type	Severity
218061	Linux Distros Unpatched Vulnerability : CVE-2014-0477	Nessus	Misc.	Local	high
78720	openSUSE Security Update : perl-Email-Address (openSUSE-SU-2014:1328-1)	Nessus	SuSE Local Security Checks	Local	medium
78018	Mandriva Linux Security Advisory : perl-Email-Address (MDVSA-2014:192)	Nessus	Mandriva Local Security Checks	Local	medium
77947	Fedora 20 : perl-Email-Address-1.905-1.fc20 (2014-7613)	Nessus	Fedora Local Security Checks	Local	medium
77946	Fedora 19 : perl-Email-Address-1.905-1.fc19 (2014-7610)	Nessus	Fedora Local Security Checks	Local	medium
76286	Debian DSA-2969-1 : libemail-address-perl - security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-0477

high

Tenable Plugins

high

medium

medium

medium

medium

medium