Amazon Linux AMI update for perl

Published: 2011-11-09

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2011-2939 CVE-2011-3597
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU33957

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-2939

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.

Mitigation

Update the affected packages:

i686:
    perl-Term-UI-0.20-119.12.amzn1.i686
    perl-suidperl-5.10.1-119.12.amzn1.i686
    perl-Object-Accessor-0.34-119.12.amzn1.i686
    perl-Pod-Escapes-1.04-119.12.amzn1.i686
    perl-Digest-SHA-5.47-119.12.amzn1.i686
    perl-CPAN-1.9402-119.12.amzn1.i686
    perl-ExtUtils-ParseXS-2.2003.0-119.12.amzn1.i686
    perl-IO-Compress-Base-2.020-119.12.amzn1.i686
    perl-Module-Build-0.3500-119.12.amzn1.i686
    perl-libs-5.10.1-119.12.amzn1.i686
    perl-ExtUtils-MakeMaker-6.55-119.12.amzn1.i686
    perl-Module-Load-0.16-119.12.amzn1.i686
    perl-Time-Piece-1.15-119.12.amzn1.i686
    perl-devel-5.10.1-119.12.amzn1.i686
    perl-ExtUtils-CBuilder-0.27-119.12.amzn1.i686
    perl-Archive-Extract-0.38-119.12.amzn1.i686
    perl-core-5.10.1-119.12.amzn1.i686
    perl-File-Fetch-0.26-119.12.amzn1.i686
    perl-version-0.77-119.12.amzn1.i686
    perl-Archive-Tar-1.58-119.12.amzn1.i686
    perl-Parse-CPAN-Meta-1.40-119.12.amzn1.i686
    perl-Params-Check-0.26-119.12.amzn1.i686
    perl-Module-CoreList-2.18-119.12.amzn1.i686
    perl-ExtUtils-Embed-1.28-119.12.amzn1.i686
    perl-CPANPLUS-0.88-119.12.amzn1.i686
    perl-Module-Loaded-0.02-119.12.amzn1.i686
    perl-Log-Message-0.02-119.12.amzn1.i686
    perl-Module-Pluggable-3.90-119.12.amzn1.i686
    perl-Log-Message-Simple-0.04-119.12.amzn1.i686
    perl-Test-Harness-3.17-119.12.amzn1.i686
    perl-IPC-Cmd-0.56-119.12.amzn1.i686
    perl-IO-Compress-Zlib-2.020-119.12.amzn1.i686
    perl-parent-0.221-119.12.amzn1.i686
    perl-Compress-Zlib-2.020-119.12.amzn1.i686
    perl-CGI-3.51-119.12.amzn1.i686
    perl-IO-Zlib-1.09-119.12.amzn1.i686
    perl-Test-Simple-0.92-119.12.amzn1.i686
    perl-Compress-Raw-Zlib-2.023-119.12.amzn1.i686
    perl-debuginfo-5.10.1-119.12.amzn1.i686
    perl-Module-Load-Conditional-0.30-119.12.amzn1.i686
    perl-Package-Constants-0.02-119.12.amzn1.i686
    perl-Time-HiRes-1.9721-119.12.amzn1.i686
    perl-Locale-Maketext-Simple-0.18-119.12.amzn1.i686
    perl-5.10.1-119.12.amzn1.i686
    perl-Pod-Simple-3.13-119.12.amzn1.i686

src:
    perl-5.10.1-119.12.amzn1.src

x86_64:
    perl-Time-HiRes-1.9721-119.12.amzn1.x86_64
    perl-Time-Piece-1.15-119.12.amzn1.x86_64
    perl-Archive-Extract-0.38-119.12.amzn1.x86_64
    perl-CPANPLUS-0.88-119.12.amzn1.x86_64
    perl-libs-5.10.1-119.12.amzn1.x86_64
    perl-parent-0.221-119.12.amzn1.x86_64
    perl-ExtUtils-CBuilder-0.27-119.12.amzn1.x86_64
    perl-ExtUtils-Embed-1.28-119.12.amzn1.x86_64
    perl-Params-Check-0.26-119.12.amzn1.x86_64
    perl-Locale-Maketext-Simple-0.18-119.12.amzn1.x86_64
    perl-ExtUtils-ParseXS-2.2003.0-119.12.amzn1.x86_64
    perl-Archive-Tar-1.58-119.12.amzn1.x86_64
    perl-Pod-Escapes-1.04-119.12.amzn1.x86_64
    perl-devel-5.10.1-119.12.amzn1.x86_64
    perl-Object-Accessor-0.34-119.12.amzn1.x86_64
    perl-Log-Message-0.02-119.12.amzn1.x86_64
    perl-5.10.1-119.12.amzn1.x86_64
    perl-Module-CoreList-2.18-119.12.amzn1.x86_64
    perl-Log-Message-Simple-0.04-119.12.amzn1.x86_64
    perl-Pod-Simple-3.13-119.12.amzn1.x86_64
    perl-Compress-Zlib-2.020-119.12.amzn1.x86_64
    perl-Parse-CPAN-Meta-1.40-119.12.amzn1.x86_64
    perl-Compress-Raw-Zlib-2.023-119.12.amzn1.x86_64
    perl-ExtUtils-MakeMaker-6.55-119.12.amzn1.x86_64
    perl-IO-Compress-Zlib-2.020-119.12.amzn1.x86_64
    perl-Module-Loaded-0.02-119.12.amzn1.x86_64
    perl-Module-Load-Conditional-0.30-119.12.amzn1.x86_64
    perl-IO-Compress-Base-2.020-119.12.amzn1.x86_64
    perl-CPAN-1.9402-119.12.amzn1.x86_64
    perl-Module-Pluggable-3.90-119.12.amzn1.x86_64
    perl-Digest-SHA-5.47-119.12.amzn1.x86_64
    perl-File-Fetch-0.26-119.12.amzn1.x86_64
    perl-CGI-3.51-119.12.amzn1.x86_64
    perl-Test-Simple-0.92-119.12.amzn1.x86_64
    perl-Module-Build-0.3500-119.12.amzn1.x86_64
    perl-version-0.77-119.12.amzn1.x86_64
    perl-debuginfo-5.10.1-119.12.amzn1.x86_64
    perl-suidperl-5.10.1-119.12.amzn1.x86_64
    perl-Package-Constants-0.02-119.12.amzn1.x86_64
    perl-IO-Zlib-1.09-119.12.amzn1.x86_64
    perl-Term-UI-0.20-119.12.amzn1.x86_64
    perl-core-5.10.1-119.12.amzn1.x86_64
    perl-IPC-Cmd-0.56-119.12.amzn1.x86_64
    perl-Test-Harness-3.17-119.12.amzn1.x86_64
    perl-Module-Load-0.16-119.12.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2011-19.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU32828