The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

The version of Oracle Enterprise Manager Grid Control installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the Bouncy Castle Java library due to     improper validation of a point within the elliptic     curve. An unauthenticated, remote attacker can exploit     this to obtain private keys by using a series of     specially crafted elliptic curve Diffie-Hellman (ECDH)     key exchanges, also known as an 'invalid curve attack.'     (CVE-2015-7940)

  - A flaw exists in the PathTools module for Perl in the     File::Spec::canonpath() function that is triggered as     strings are returned as untainted even when passing     tainted input. An unauthenticated, remote attacker can     exploit this to pass unvalidated user input to sensitive     or insecure areas. (CVE-2015-8607)

  - An overflow condition exists in Perl in the MapPathA()     function due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-8608)

  - A remote code execution vulnerability exists in the     Apache Struts component due to improper handling of     multithreaded access to an ActionForm instance. An     unauthenticated, remote attacker can exploit this, via a     specially crafted multipart request, to execute     arbitrary code or cause a denial of service condition.
    (CVE-2016-1181)

  - A flaw exists in Perl that is triggered during the     handling of variables that appear twice in the     environment (envp), causing the last value to appear in     %ENV, while getenv would return the first. An     unauthenticated, remote attacker can exploit this to     cause variables to be incorrectly propagated to     subprocesses, regardless of the protections offered by     taint checking. (CVE-2016-2381)

  - A denial of service vulnerability exists in the Apache     Commons FileUpload component due to improper handling of     boundaries in content-type headers when handling file     upload requests. An unauthenticated, remote attacker can     exploit this to cause processes linked against the     library to become unresponsive. (CVE-2016-3092)

  - A man-in-the-middle vulnerability exists in various     components, known as 'httpoxy', due to a failure to     properly resolve namespace conflicts in accordance with     RFC 3875 section 4.1.18. The HTTP_PROXY environment     variable is set based on untrusted user data in the     'Proxy' header of HTTP requests. The HTTP_PROXY     environment variable is used by some web client     libraries to specify a remote proxy server. An     unauthenticated, remote attacker can exploit this, via a     crafted 'Proxy' header in an HTTP request, to redirect     an application's internal HTTP traffic to an arbitrary     proxy server where it may be observed or manipulated.
    (CVE-2016-5385, CVE-2016-5386, CVE-2016-5387,     CVE-2016-5388)

  - A carry propagating error exists in the OpenSSL     component in the x86_64 Montgomery squaring     implementation that may cause the BN_mod_exp() function     to produce incorrect results. An unauthenticated, remote     attacker with sufficient resources can exploit this to     obtain sensitive information regarding private keys.
    Moreover, the attacker would additionally need online     access to an unpatched system using the target private     key in a scenario with persistent DH parameters and a     private key that is shared between multiple clients. For     example, this can occur by default in OpenSSL DHE based     SSL/TLS cipher suites. (CVE-2017-3732)

  - An unspecified flaw exists in the UI Framework component    that allows authenticated, remote attacker to have an    impact on integrity. (CVE-2017-10091)

The remote host is affected by the vulnerability described in GLSA-201701-75 (Perl: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Perl. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or       escalate privileges.
  Workaround :

    There is no known workaround at this time.

This update for perl fixes the following issues :

  - CVE-2016-2381: Fixed environment duplicated variable     handling bug [boo#967082]

  - fix memory leak in 'use utf8' handling [boo#928292]

  - CVE-2015-8607: Fixed taint propagation in canonpath     [boo#961528]

This release fixes CVE-2015-8607 (losing taint flag in File::Spec::canonpath() subroutine).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

David Golden discovered that the canonpath function in the Perl File::Spec module did not properly preserve the taint attribute. An attacker could possibly use this issue to bypass the taint protection mechanism.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ricardo Signes reports :

Beginning in PathTools 3.47 and/or perl 5.20.0, the File::Spec::canonpath() routine returned untained strings even if passed tainted input. This defect undermines the guarantee of taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code.

This defect was found and reported by David Golden of MongoDB.

David Golden of MongoDB discovered that File::Spec::canonpath() in Perl returned untainted strings even if passed tainted input. This defect undermines taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code.

The oldstable distribution (wheezy) is not affected by this problem.

ID	Name	Product	Family	Severity
101837	Oracle Enterprise Manager Grid Control Multiple Vulnerabilities (July 2017 CPU) (httpoxy)	Nessus	Misc.	critical
96861	GLSA-201701-75 : Perl: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
90164	openSUSE Security Update : perl (openSUSE-2016-386)	Nessus	SuSE Local Security Checks	high
89560	Fedora 23 : perl-PathTools-3.60-2.fc23 (2016-69e506e02d)	Nessus	Fedora Local Security Checks	high
89537	Fedora 22 : perl-PathTools-3.47-312.fc22 (2016-4ca904238f)	Nessus	Fedora Local Security Checks	high
88083	Ubuntu 15.04 / 15.10 : perl vulnerability (USN-2878-1)	Nessus	Ubuntu Local Security Checks	high
87885	FreeBSD : p5-PathTools -- File::Spec::canonpath loses taint (333f655a-b93a-11e5-9efa-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	high
87853	Debian DSA-3441-1 : perl - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8607

high

Tenable Plugins

critical

high

high

high

high

high

high

high