Vulnerabilities > CVE-2016-1238 - Permissions, Privileges, and Access Controls vulnerability in multiple products

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

Vulnerable Configurations

Part	Description	Count
OS	Debian Debian Debian Linux 8.0	1
OS	Fedoraproject Fedoraproject Fedora 24 Fedoraproject Fedora 23	2
OS	Opensuse Opensuse Leap 15.0	1
Application	Perl Perl Perl 5.003_92 Perl Perl 5.21.1 Perl Perl 5.9.3 Perl Perl 5.14.1 Perl Perl 5.8.0 Perl Perl 5.003_97 Perl Perl 5.6.0 Perl Perl 5.17.11 Perl Perl 5.24.1 Perl Perl 5.16.0 Perl Perl 5.19.6 Perl Perl 5.22.3 Perl Perl 5.17.4 Perl Perl 5.003_03 Perl Perl 5.18.4 Perl Perl 5.18.2 Perl Perl 5.8.4 Perl Perl 5.15.6 Perl Perl 5.004_04 Perl Perl 5.12.0 Perl Perl 5.9.5 Perl Perl 5.004_02 Perl Perl 5.003_12 Perl Perl 5.18.3 Perl Perl 5.13.10 Perl Perl 5.003_24 Perl Perl 5.17.1 Perl Perl 5.22.0 Perl Perl 5.8 Perl Perl 5.003_97E Perl Perl 5.8.1 Perl Perl 5.21.7 Perl Perl 5.12.4 Perl Perl 5.15.2 Perl Perl 5.8.9 Perl Perl 5.20.2 Perl Perl 5.000 Perl Perl 5.18.0 Perl Perl 5.15.0 Perl Perl 5.12.1 Perl Perl 5.003_09 Perl Perl 5.12.5 Perl Perl 5.005_04 Perl Perl 5.005_01 Perl Perl 1.0.16 Perl Perl 5.003_90 Perl Perl 5.14.4 Perl Perl 5.21.4 Perl Perl 5.15.3 Perl Perl 5.24.0 Perl Perl 5.6 Perl Perl 5.17.9 Perl Perl 5.21.9 Perl Perl 5.6.1 Perl Perl 5.13.8 Perl Perl 5.003_21 Perl Perl 5.003_15 Perl Perl 5.003_26 Perl Perl 5.003_97F Perl Perl 5.11.2 Perl Perl 5.13.0 Perl Perl 5.21.6 Perl Perl 5.19.10 Perl Perl 5.14.0 Perl Perl 5.22.1 Perl Perl 5.14.3 Perl Perl 5.12.3 Perl Perl 5.13.5 Perl Perl 5.20.3 Perl Perl 5.13.3 Perl Perl 5.7.3 Perl Perl 5.003_94 Perl Perl 5.003_97J Perl Perl 5.9.2 Perl Perl 5.13.6 Perl Perl 5.003_10 Perl Perl 5.19.5 Perl Perl 5.9.0 Perl Perl 5.003_27 Perl Perl 5.003_19 Perl Perl 5.003_97G Perl Perl 5.001 Perl Perl 5.19.3 Perl Perl 5.13.11 Perl Perl 5.8.2 Perl Perl 5.17.10 Perl Perl 5.11.1 Perl Perl 5.8.5 Perl Perl 5.19.2 Perl Perl 5.13.7 Perl Perl 5.19.11 Perl Perl 5.10 Perl Perl 5.13.1 Perl Perl 5.10.1 Perl Perl 5.17.8 Perl Perl 5.16.3 Perl Perl 5.003_20 Perl Perl 5.22.2 Perl Perl 5.003_97I Perl Perl 5.19.0 Perl Perl 5.003_14 Perl Perl 5.003_28 Perl Perl 5.21.2 Perl Perl 5.003_17 Perl Perl 5.003 Perl Perl 5.003_91 Perl Perl 5.16.1 Perl Perl 5.003_04 Perl Perl 5.11.5 Perl Perl 5.003_25 Perl Perl 5.003_01 Perl Perl 5.17.5 Perl Perl 5.21.3 Perl Perl 5.6.2 Perl Perl 5.11.0 Perl Perl 5.19.9 Perl Perl 5.004_05 Perl Perl 5.17.2 Perl Perl 5.21.8 Perl Perl 5.003_13 Perl Perl 5.004_01 Perl Perl 5.15.9 Perl Perl 5.003_16 Perl Perl 5.19.8 Perl Perl 5.12.2 Perl Perl 5.003_97C Perl Perl 5.002_01 Perl Perl 5.20.1 Perl Perl 5.21.10 Perl Perl 5.003_07 Perl Perl 5.003_02 Perl Perl 5.001N Perl Perl 5.8.7 Perl Perl 5.17.0 Perl Perl 5.003_95 Perl Perl 5.003_93 Perl Perl 5.11.3 Perl Perl 5.15.5 Perl Perl 5.13.4 Perl Perl 5.17.7 Perl Perl 5.17.3 Perl Perl 5.15.8 Perl Perl 1.0.15 Perl Perl 5.005 Perl Perl 5.17.7.0 Perl Perl 5.004 Perl Perl 5.004_03 Perl Perl 5.003_97H Perl Perl 5.21.11 Perl Perl 5.15.4 Perl Perl 5.9.4 Perl Perl 5.17.6 Perl Perl 5.003_99A Perl Perl 5.21.0 Perl Perl 5.005_03 Perl Perl 5.19.7 Perl Perl 5.19.1 Perl Perl 5.11.4 Perl Perl 5.000O Perl Perl 5.16.2 Perl Perl 5.20.0 Perl Perl 5.003_05 Perl Perl 5.21.5 Perl Perl 5.14.2 Perl Perl 5.13.9 Perl Perl 5.9.1 Perl Perl 5.003_97B Perl Perl 5.003_96 Perl Perl 5.19.4 Perl Perl 5.8.3 Perl Perl 5.8.6 Perl Perl 5.003_08 Perl Perl 5.003_18 Perl Perl 5.005_02 Perl Perl 5.10.0 Perl Perl 5.8.8 Perl Perl 5.15.1 Perl Perl 5.13.2 Perl Perl 5.18.1 Perl Perl 5.003_98 Perl Perl 5.003_99 Perl Perl 5.003_23 Perl Perl 5.003_11 Perl Perl 5.002 Perl Perl 5.15.7 Perl Perl 5.003_97A Perl Perl 5.003_22 Perl Perl 5.003_97D	248
Application	Apache Apache Spamassassin - Apache Spamassassin 3.0.1 Apache Spamassassin 3.0.2 Apache Spamassassin 3.0.3 Apache Spamassassin 3.0.4 Apache Spamassassin 3.0.6 Apache Spamassassin 3.1.0 Apache Spamassassin 3.1.1 Apache Spamassassin 3.1.2 Apache Spamassassin 3.1.3 Apache Spamassassin 3.1.4 Apache Spamassassin 3.1.5 Apache Spamassassin 3.1.6 Apache Spamassassin 3.1.7 Apache Spamassassin 3.1.8 Apache Spamassassin 3.2.0 Apache Spamassassin 3.2.1 Apache Spamassassin 3.2.2 Apache Spamassassin 3.2.3 Apache Spamassassin 3.2.4 Apache Spamassassin 3.2.5 Apache Spamassassin 3.3.0 Apache Spamassassin 3.3.1 Apache Spamassassin 3.3.2 Apache Spamassassin 3.4.0 Apache Spamassassin 3.4.1	26

Common Weakness Enumeration (CWE)

CWE-264 - Permissions, Privileges, and Access Controls

Common Attack Pattern Enumeration and Classification (CAPEC)

Accessing, Modifying or Executing Executable Files
An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
Blue Boxing
This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
Restful Privilege Elevation
Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
Target Programs with Elevated Privileges
This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Nessus

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-2648.NASL
description	According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.(CVE-2016-1238) - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.(CVE-2013-7422) - The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.(CVE-2014-4330) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-08
modified	2019-12-18
plugin id	132183
published	2019-12-18
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/132183
title	EulerOS 2.0 SP3 : perl (EulerOS-SA-2019-2648)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(132183); script_version("1.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/07"); script_cve_id( "CVE-2013-7422", "CVE-2014-4330", "CVE-2016-1238" ); script_bugtraq_id( 70142, 75704 ); script_name(english:"EulerOS 2.0 SP3 : perl (EulerOS-SA-2019-2648)"); script_summary(english:"Checks the rpm output for the updated packages."); script_set_attribute(attribute:"synopsis", value: "The remote EulerOS host is missing multiple security updates."); script_set_attribute(attribute:"description", value: "According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.(CVE-2016-1238) - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.(CVE-2013-7422) - The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.(CVE-2014-4330) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues."); # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2648 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4cca0e92"); script_set_attribute(attribute:"solution", value: "Update the affected perl packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"patch_publication_date", value:"2019/12/18"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/18"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perl-macros"); script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Huawei Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp"); script_exclude_keys("Host/EulerOS/uvp_version"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/EulerOS/release"); if (isnull(release) \|\| release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS"); if (release !~ "^EulerOS release 2\.0(\D\|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0"); sp = get_kb_item("Host/EulerOS/sp"); if (isnull(sp) \|\| sp !~ "^(3)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3"); uvp = get_kb_item("Host/EulerOS/uvp_version"); if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP3", "EulerOS UVP " + uvp); if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu); flag = 0; pkgs = ["perl-5.16.3-285.h7", "perl-core-5.16.3-285.h7", "perl-devel-5.16.3-285.h7", "perl-libs-5.16.3-285.h7", "perl-macros-5.16.3-285.h7"]; foreach (pkg in pkgs) if (rpm_check(release:"EulerOS-2.0", sp:"3", reference:pkg)) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-0505-1.NASL
description	This update for amavisd-new fixes the following issues : wmavisd-new was updated to version 2.11.1 (bsc#1123389) : removed a trailing dot element from @INC, as a workaround for a perl vulnerability CVE-2016-1238 (bsc#987887) amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR for a message
last seen	2020-06-01
modified	2020-06-02
plugin id	122478
published	2019-02-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122478
title	SUSE SLED15 / SLES15 Security Update : amavisd-new (SUSE-SU-2019:0505-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2019:0505-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(122478); script_version("1.3"); script_cvs_date("Date: 2020/02/07"); script_cve_id("CVE-2016-1238"); script_name(english:"SUSE SLED15 / SLES15 Security Update : amavisd-new (SUSE-SU-2019:0505-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for amavisd-new fixes the following issues : wmavisd-new was updated to version 2.11.1 (bsc#1123389) : removed a trailing dot element from @INC, as a workaround for a perl vulnerability CVE-2016-1238 (bsc#987887) amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR for a message 'PID <pid> went away', and removed redundant newlines from some log messages </pid> safe_decode() and safe_decode_utf8(): avoid warning messages 'Use of uninitialized value in subroutine entry' in Encode::MIME::Header when the $check argument is undefined @sa_userconf_maps has been extended to allow loading of per-recipient (or per-policy bank, or global) SpamAssassin configuration set from LDAP. For consistency with SQL a @sa_userconf_maps entry prefixed with 'ldap:' will load SpamAssassin configuration set using the load_scoreonly_ldap() method; a patch by Atanas Karashenski add some Sanesecurity.Foxhole false positives to the default list @virus_name_to_spam_score_maps updated some comments Update amavis-milter to version 2.6.1: Fixed bug when creating amavisd-new policy bank names Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1123389" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=987887" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2016-1238/" ); # https://www.suse.com/support/update/announcement/2019/suse-su-20190505-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?1f3fa046" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-505=1" ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:amavisd-new"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:amavisd-new-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:amavisd-new-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:amavisd-new-docs"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/08/02"); script_set_attribute(attribute:"patch_publication_date", value:"2019/02/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/27"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLED15\|SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED15 / SLES15", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0", os_ver + " SP" + sp); if (os_ver == "SLED15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED15 SP0", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES15", sp:"0", reference:"amavisd-new-2.11.1-6.3.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"amavisd-new-debuginfo-2.11.1-6.3.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"amavisd-new-debugsource-2.11.1-6.3.1")) flag++; if (rpm_check(release:"SLES15", sp:"0", reference:"amavisd-new-docs-2.11.1-6.3.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"amavisd-new-2.11.1-6.3.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"amavisd-new-debuginfo-2.11.1-6.3.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"amavisd-new-debugsource-2.11.1-6.3.1")) flag++; if (rpm_check(release:"SLED15", sp:"0", reference:"amavisd-new-docs-2.11.1-6.3.1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "amavisd-new"); }

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2016-1086.NASL
description	This update for Perl fixes the following issues : - CVE-2016-6185: Xsloader looking at a
last seen	2020-06-05
modified	2016-09-19
plugin id	93583
published	2016-09-19
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/93583
title	openSUSE Security Update : perl (openSUSE-2016-1086)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2016-1086. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(93583); script_version("2.3"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2015-8853", "CVE-2016-1238", "CVE-2016-2381", "CVE-2016-6185"); script_name(english:"openSUSE Security Update : perl (openSUSE-2016-1086)"); script_summary(english:"Check for the openSUSE-2016-1086 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update for Perl fixes the following issues : - CVE-2016-6185: Xsloader looking at a '(eval)' directory. (bsc#988311) - CVE-2016-1238: Searching current directory for optional modules. (bsc#987887) - CVE-2015-8853: Regular expression engine hanging on bad utf8. (bsc) - CVE-2016-2381: Environment dup handling bug. (bsc#967082) - 'Insecure dependency in require' error in taint mode. (bsc#984906) - Memory leak in 'use utf8' handling. (bsc#928292) - Missing lock prototype to the debugger. (bsc#932894) This update was imported from the SUSE:SLE-12:Update update project." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=928292" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=932894" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=967082" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=984906" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=987887" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.opensuse.org/show_bug.cgi?id=988311" ); script_set_attribute(attribute:"solution", value:"Update the affected perl packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-base-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-base-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-base-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:perl-debugsource"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.1"); script_set_attribute(attribute:"patch_publication_date", value:"2016/09/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/09/19"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2020 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE42\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE42.1", reference:"perl-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"perl-base-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"perl-base-debuginfo-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"perl-debuginfo-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", reference:"perl-debugsource-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"perl-32bit-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"perl-base-32bit-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"perl-base-debuginfo-32bit-5.18.2-5.1") ) flag++; if ( rpm_check(release:"SUSE42.1", cpu:"x86_64", reference:"perl-debuginfo-32bit-5.18.2-5.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "perl-32bit / perl / perl-base-32bit / perl-base / etc"); }

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_72BFBB095A6A11E6A6C314DAE9D210B8.NASL
description	Sawyer X reports : Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
last seen	2020-06-01
modified	2020-06-02
plugin id	92741
published	2016-08-05
reporter	This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92741
title	FreeBSD : perl -- local arbitrary code execution (72bfbb09-5a6a-11e6-a6c3-14dae9d210b8)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-DD20A4631A.NASL
description	This update adds an option
last seen	2020-06-05
modified	2016-08-09
plugin id	92810
published	2016-08-09
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92810
title	Fedora 24 : perl-Module-Load-Conditional (2016-dd20a4631a)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_613193A0C1B411E8AE2D54E1AD3D6335.NASL
description	the Apache Spamassassin project reports : In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the
last seen	2020-06-01
modified	2020-06-02
plugin id	117721
published	2018-09-27
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/117721
title	FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201701-75.NASL
description	The remote host is affected by the vulnerability described in GLSA-201701-75 (Perl: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Perl. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or escalate privileges. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	96861
published	2017-01-30
reporter	This script is Copyright (C) 2017 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/96861
title	GLSA-201701-75 : Perl: Multiple vulnerabilities

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1831.NASL
description	This update for spamassassin to version 3.4.2 fixes the following issues : Security issues fixed : - CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748). - CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750). - CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745). - CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749). Non-security issues fixed : - Use systemd timers instead of cron (bsc#1115411) - Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765) - Fixed warning about deprecated regex during sa-update (bsc#1069831) This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	127739
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127739
title	openSUSE Security Update : spamassassin (openSUSE-2019-1831)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3628.NASL
description	Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-1238 John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory (which might be changed to another directory without the user realising) and potentially leading to privilege escalation, as demonstrated in Debian with certain combinations of installed packages. The problem relates to Perl loading modules from the includes directory array (
last seen	2020-06-01
modified	2020-06-02
plugin id	92548
published	2016-07-26
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92548
title	Debian DSA-3628-1 : perl - security update

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-0AA251BC9B.NASL
description	This update adds an option
last seen	2020-06-05
modified	2016-08-09
plugin id	92797
published	2016-08-09
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92797
title	Fedora 23 : perl-Module-Load-Conditional (2016-0aa251bc9b)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-565.NASL
description	Multiple vulnerabilities were discovered in the implementation of the Perl programming language. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-1238 John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory (which might be changed to another directory without the user realising) and potentially leading to privilege escalation, as demonstrated in Debian with certain combinations of installed packages. The problem relates to Perl loading modules from the includes directory array (
last seen	2020-03-17
modified	2016-07-29
plugin id	92613
published	2016-07-29
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/92613
title	Debian DLA-565-1 : perl security update

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2246-1.NASL
description	This update for perl fixes the following issues : - CVE-2016-6185: xsloader looking at a
last seen	2020-06-01
modified	2020-06-02
plugin id	93371
published	2016-09-08
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93371
title	SUSE SLES11 Security Update : perl (SUSE-SU-2016:2246-1)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-E9E5C081D4.NASL
description	Security fix for CVE-2016-1238 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-08-05
plugin id	92738
published	2016-08-05
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/92738
title	Fedora 24 : 4:perl (2016-e9e5c081d4)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1578.NASL
description	Multiple vulnerabilities were found in Spamassassin, which could lead to Remote Code Execution and Denial of Service attacks under certain circumstances. CVE-2016-1238 Many Perl programs do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. CVE-2017-15705 A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. CVE-2018-11780 A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2. CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. For Debian 8
last seen	2020-06-01
modified	2020-06-02
plugin id	118938
published	2018-11-14
reporter	This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118938
title	Debian DLA-1578-1 : spamassassin security update

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-2011-1.NASL
description	This update for spamassassin to version 3.4.2 fixes the following issues : Security issues fixed : CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748). CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750). CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745). CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749). Non-security issues fixed: Use systemd timers instead of cron (bsc#1115411) Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765) Fixed warning about deprecated regex during sa-update (bsc#1069831) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	127751
published	2019-08-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127751
title	SUSE SLED15 / SLES15 Security Update : spamassassin (SUSE-SU-2019:2011-1)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2020-1196.NASL
description	According to the versions of the perl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.(CVE-2013-7422) - It was found that perl can load modules from the current directory if not found in the module directories, via the @INC path. A local, authenticated attacker could create a specially crafted module in a writable directory and trick a user into running a perl program from that directory if the module is not found in previous @INC paths, it will load and execute the attacker
last seen	2020-03-19
modified	2020-03-13
plugin id	134485
published	2020-03-13
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/134485
title	EulerOS Virtualization for ARM 64 3.0.2.0 : perl (EulerOS-SA-2020-1196)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-584.NASL
description	John Lightsey and Todd Rinaldo reported that the opportunistic loading of optional modules can make many programs unintentionally load code from the current working directory (which might be changed to another directory without the user realising) and potentially leading to privilege escalation, as demonstrated in Debian with certain combinations of installed packages. The problem relates to Perl loading modules from the includes directory array (
last seen	2020-03-17
modified	2016-08-05
plugin id	92727
published	2016-08-05
reporter	This script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/92727
title	Debian DLA-584-1 : libsys-syslog-perl security update

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2019-1961-1.NASL
description	This update for spamassassin to version 3.4.2 fixes the following issues : Security issues fixed : CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745). CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748). CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750). Non-security issues fixed: Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules GeoIP2 support has been added to RelayCountry and URILocalBL plugins Several new or enhanced configuration options Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	127038
published	2019-07-25
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127038
title	SUSE SLED12 / SLES12 Security Update : spamassassin (SUSE-SU-2019:1961-1)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-297.NASL
description	This update for amavisd-new fixes the following issues : Security issue fixed : - CVE-2016-1238: Workedaround a perl vulnerability by removing a trailing dot element from @INC (bsc#987887). Other issues addressed : - update to version 2.11.1 (bsc#1123389). - amavis-services: bumping up syslog level from LOG_NOTICE to LOG_ERR for a message
last seen	2020-06-01
modified	2020-06-02
plugin id	122662
published	2019-03-07
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122662
title	openSUSE Security Update : amavisd-new (openSUSE-2019-297)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2016-6EC2009080.NASL
description	Security fix for CVE-2016-1238 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2016-08-22
plugin id	93058
published	2016-08-22
reporter	This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93058
title	Fedora 23 : 4:perl (2016-6ec2009080)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-2419.NASL
description	According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.(CVE-2014-4330) - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.(CVE-2013-7422) - (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.(CVE-2016-1238) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-08
modified	2019-12-10
plugin id	131911
published	2019-12-10
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/131911
title	EulerOS 2.0 SP2 : perl (EulerOS-SA-2019-2419)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-2263-1.NASL
description	This update for Perl fixes the following issues : - CVE-2016-6185: Xsloader looking at a
last seen	2020-06-01
modified	2020-06-02
plugin id	93437
published	2016-09-12
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93437
title	SUSE SLED12 / SLES12 Security Update : perl (SUSE-SU-2016:2263-1)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2020-1476.NASL
description	According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.(CVE-2013-7422) - 1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.(CVE-2016-1238) - The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.(CVE-2016-6185) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-04-30
modified	2020-04-16
plugin id	135638
published	2020-04-16
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/135638
title	EulerOS Virtualization 3.0.2.2 : perl (EulerOS-SA-2020-1476)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201812-07.NASL
description	The remote host is affected by the vulnerability described in GLSA-201812-07 (SpamAssassin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in SpamAssassin. Please review the referenced CVE identifiers for details. Impact : A remote attacker could execute arbitrary code, escalate privileges, or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
last seen	2020-03-28
modified	2018-12-17
plugin id	119703
published	2018-12-17
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119703
title	GLSA-201812-07 : SpamAssassin: Multiple vulnerabilities

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-2220.NASL
description	According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.(CVE-2013-7422) - (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.(CVE-2016-1238) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-08
modified	2019-11-08
plugin id	130682
published	2019-11-08
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/130682
title	EulerOS 2.0 SP5 : perl (EulerOS-SA-2019-2220)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

References