An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3136-1 advisory.

    - CVE-2014-10401: Fixed incorrect permission on opening files via DBD::File drivers (bsc#1176492)
      - CVE-2014-10402: Fixed incorrect permission on opening files via DBD::File drivers (bsc#1176492)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3035 advisory.

    It was discovered that CVE-2014-10401 was fixed incompletely in the Perl5 Database Interface (DBI). An     attacker could trigger information disclosure through a different vector. CVE-2014-10401 DBD::File drivers     can open files from folders other than those specifically passed via the f_dir attribute. CVE-2014-10402     DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute     in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.
    For Debian 9 stretch, this problem has been fixed in version 1.636-1+deb9u2. We recommend that you upgrade     your libdbi-perl packages. For the detailed security status of libdbi-perl please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/libdbi-perl Further information about Debian     LTS security advisories, how to apply these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5030-2 advisory.

    USN-5030-1 addressed vulnerabilities in Perl DBI module. This

    update provides the corresponding updates for Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

  - An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's     availability. (CVE-2020-14392)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from     folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE:
    this issue exists because of an incomplete fix for CVE-2014-10401. (CVE-2014-10402)

  - An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's     availability. (CVE-2020-14392)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5030-1 advisory.

    It was discovered that the Perl DBI module incorrectly opened files outside of the folder specified in the     data source name. A remote attacker could possibly use this issue to obtain sensitive information.
    (CVE-2014-10402)

    It was discovered that the Perl DBI module incorrectly handled certain long strings. A local attacker     could possibly use this issue to cause the DBI module to crash, resulting in a denial of service. This     issue only affected Ubuntu 18.04 LTS. (CVE-2020-14393)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

  - A buffer overflow was found in perl-DBI before version     1.643 in DBI.xs. This flaw allows a local attacker who     can supply a string longer than 300 characters to cause     an out-of-bounds write. The highest threat from this     vulnerability is to integrity and system     availability.(CVE-2020-14393)

  - An untrusted pointer dereference flaw was found in     Perl-DBI before version 1.643. This flaw allows a local     attacker who can manipulate calls to dbd_db_login6_sv()     to cause memory corruption. The highest threat from     this vulnerability is to system     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module before 1.632     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute.(CVE-2014-10401)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the DBI module before 1.643     for Perl. The hv_fetch() documentation requires     checking for NULL and the code does that. But, shortly     thereafter, it calls SvOK(profile), causing a NULL     pointer dereference.(CVE-2019-20919)

  - A buffer overflow was found in perl-DBI < 1.643 in     DBI.xs. A local attacker who is able to supply a string     longer than 300 characters could cause an out-of-bounds     write, affecting the availability of the service or     integrity of data.(CVE-2020-14393)

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-DBI package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An untrusted pointer dereference flaw was found in     Perl-DBI < 1.643. A local attacker who is able to     manipulate calls to dbd_db_login6_sv() could cause     memory corruption, affecting the service's     availability.(CVE-2020-14392)

  - An issue was discovered in the DBI module through 1.643     for Perl. DBD::File drivers can open files from folders     other than those specifically passed via the f_dir     attribute in the data source name (DSN). NOTE: this     issue exists because of an incomplete fix for     CVE-2014-10401.(CVE-2014-10402)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). [bsc#1176492, CVE-2014-10401, CVE-2014-10402]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

DBD::File drivers could open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). [bsc#1176492, CVE-2014-10401, CVE-2014-10402]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for perl-DBI fixes the following issues :

  - DBD::File drivers could open files from folders other     than those specifically passed via the f_dir attribute     in the data source name (DSN). [bsc#1176492,     CVE-2014-10401, CVE-2014-10402]

This update was imported from the SUSE:SLE-15:Update update project.

This update for perl-DBI fixes the following issues :

  - DBD::File drivers can open files from folders other than     those specifically passed via the f_dir attribute in the     data source name (DSN). [bsc#1176492, CVE-2014-10401,     CVE-2014-10402]

This update was imported from the SUSE:SLE-15-SP2:Update update project.

ID	Name	Product	Family	Severity
218116	Linux Distros Unpatched Vulnerability : CVE-2014-10402	Nessus	Misc.	medium
206634	SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2024:3136-1)	Nessus	SuSE Local Security Checks	medium
161684	Debian DLA-3035-1 : libdbi-perl - LTS security update	Nessus	Debian Local Security Checks	medium
158029	EulerOS Virtualization 3.0.6.6 : perl-DBI (EulerOS-SA-2022-1137)	Nessus	Huawei Local Security Checks	medium
157372	Ubuntu 16.04 ESM : Perl DBI module vulnerabilities (USN-5030-2)	Nessus	Ubuntu Local Security Checks	high
156503	EulerOS Virtualization 3.0.2.6 : perl-DBI (EulerOS-SA-2021-2908)	Nessus	Huawei Local Security Checks	medium
154382	EulerOS 2.0 SP3 : perl-DBI (EulerOS-SA-2021-2605)	Nessus	Huawei Local Security Checks	medium
153344	EulerOS 2.0 SP2 : perl-DBI (EulerOS-SA-2021-2421)	Nessus	Huawei Local Security Checks	medium
153082	EulerOS 2.0 SP5 : perl-DBI (EulerOS-SA-2021-2343)	Nessus	Huawei Local Security Checks	medium
152230	Ubuntu 18.04 LTS / 20.04 LTS : Perl DBI module vulnerabilities (USN-5030-1)	Nessus	Ubuntu Local Security Checks	high
151304	EulerOS Virtualization for ARM 64 3.0.2.0 : perl-DBI (EulerOS-SA-2021-2112)	Nessus	Huawei Local Security Checks	high
147693	EulerOS Virtualization 2.9.0 : perl-DBI (EulerOS-SA-2021-1650)	Nessus	Huawei Local Security Checks	high
147556	EulerOS Virtualization 2.9.1 : perl-DBI (EulerOS-SA-2021-1622)	Nessus	Huawei Local Security Checks	high
147044	EulerOS Virtualization for ARM 64 3.0.6.0 : perl-DBI (EulerOS-SA-2021-1552)	Nessus	Huawei Local Security Checks	high
144130	EulerOS 2.0 SP8 : perl-DBI (EulerOS-SA-2020-2525)	Nessus	Huawei Local Security Checks	medium
143879	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:3384-1)	Nessus	SuSE Local Security Checks	medium
143676	SUSE SLED15 / SLES15 Security Update : perl-DBI (SUSE-SU-2020:3385-1)	Nessus	SuSE Local Security Checks	medium
143409	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2488)	Nessus	Huawei Local Security Checks	medium
143399	EulerOS 2.0 SP9 : perl-DBI (EulerOS-SA-2020-2501)	Nessus	Huawei Local Security Checks	medium
143355	openSUSE Security Update : perl-DBI (openSUSE-2020-2051)	Nessus	SuSE Local Security Checks	medium
143331	openSUSE Security Update : perl-DBI (openSUSE-2020-2064)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-10402

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium