National Cyber Awareness System

Vulnerability Summary for CVE-2010-1168

Overview

The Safe (aka Safe.pm) module before 2.25 for Perl allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving implicitly called methods and implicitly blessed objects, as demonstrated by the (a) DESTROY and (b) AUTOLOAD methods, related to "automagic methods."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=576508

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=576508

External Source: VUPEN

Name: ADV-2010-3075

Hyperlink:http://www.vupen.com/english/advisories/2010/3075

External Source: REDHAT

Name: RHSA-2010:0458

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0458.html

External Source: REDHAT

Name: RHSA-2010:0457

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0457.html

External Source: MLIST

Name: [oss-security] 20100520 CVE-2010-1974 reject request (dupe of CVE-2010-1168) and CVE-2010-1447 description modification request

Hyperlink:http://www.openwall.com/lists/oss-security/2010/05/20/5

External Source: MANDRIVA

Name: MDVSA-2010:116

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:116

External Source: MANDRIVA

Name: MDVSA-2010:115

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:115

External Source: SECTRACK

Name: 1024062

Type: Advisory

Hyperlink:http://securitytracker.com/id?1024062

External Source: SECUNIA

Name: 42402

Hyperlink:http://secunia.com/advisories/42402

External Source: SECUNIA

Name: 40052

Type: Advisory

Hyperlink:http://secunia.com/advisories/40052

External Source: SECUNIA

Name: 40049

Type: Advisory

Hyperlink:http://secunia.com/advisories/40049

External Source: OVAL

Name: oval:org.mitre.oval:def:9807

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9807

External Source: OVAL

Name: oval:org.mitre.oval:def:7424

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7424

External Source: CONFIRM

Name: http://cpansearch.perl.org/src/RGARCIA/Safe-2.27/Changes

Hyperlink:http://cpansearch.perl.org/src/RGARCIA/Safe-2.27/Changes

External Source: CONFIRM

Name: http://blogs.sun.com/security/entry/cve_2010_1168_vulnerability_in

Hyperlink:http://blogs.sun.com/security/entry/cve_2010_1168_vulnerability_in

External Source: CONFIRM

Name: http://blogs.perl.org/users/rafael_garcia-suarez/2010/03/new-safepm-fixes-security-hole.html

Hyperlink:http://blogs.perl.org/users/rafael_garcia-suarez/2010/03/new-safepm-fixes-security-hole.html

References to Check Content

Identifier:oval:org.mitre.oval:def:7424

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:7424

Identifier:oval:org.mitre.oval:def:9807

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9807