CVE-2016-1238 : Détail

CVE-2016-1238

7.8
/
Haute
A01-Broken Access Control
0.05%V3
Local
2016-08-02
12h00 +00:00
2019-08-06
18h06 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-264 Category : Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Local

The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Low

The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

None

The vulnerable system can be exploited without interaction from any user.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.

 [email protected]
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Products Mentioned

Configuraton 0

Debian>>Debian_linux >> Version 8.0

Fedoraproject>>Fedora >> Version 23

Fedoraproject>>Fedora >> Version 24

Configuraton 0

Perl>>Perl >> Version 1.0.15

Perl>>Perl >> Version 1.0.16

Perl>>Perl >> Version 5.000

Perl>>Perl >> Version 5.000o

Perl>>Perl >> Version 5.001

Perl>>Perl >> Version 5.001n

Perl>>Perl >> Version 5.002

Perl>>Perl >> Version 5.002_01

Perl>>Perl >> Version 5.003

Perl>>Perl >> Version 5.003_01

Perl>>Perl >> Version 5.003_02

Perl>>Perl >> Version 5.003_03

Perl>>Perl >> Version 5.003_04

Perl>>Perl >> Version 5.003_05

Perl>>Perl >> Version 5.003_07

Perl>>Perl >> Version 5.003_08

Perl>>Perl >> Version 5.003_09

Perl>>Perl >> Version 5.003_10

Perl>>Perl >> Version 5.003_11

Perl>>Perl >> Version 5.003_12

Perl>>Perl >> Version 5.003_13

Perl>>Perl >> Version 5.003_14

Perl>>Perl >> Version 5.003_15

Perl>>Perl >> Version 5.003_16

Perl>>Perl >> Version 5.003_17

Perl>>Perl >> Version 5.003_18

Perl>>Perl >> Version 5.003_19

Perl>>Perl >> Version 5.003_20

Perl>>Perl >> Version 5.003_21

Perl>>Perl >> Version 5.003_22

Perl>>Perl >> Version 5.003_23

Perl>>Perl >> Version 5.003_24

Perl>>Perl >> Version 5.003_25

Perl>>Perl >> Version 5.003_26

Perl>>Perl >> Version 5.003_27

Perl>>Perl >> Version 5.003_28

Perl>>Perl >> Version 5.003_90

Perl>>Perl >> Version 5.003_91

Perl>>Perl >> Version 5.003_92

Perl>>Perl >> Version 5.003_93

Perl>>Perl >> Version 5.003_94

Perl>>Perl >> Version 5.003_95

Perl>>Perl >> Version 5.003_96

Perl>>Perl >> Version 5.003_97

Perl>>Perl >> Version 5.003_97a

Perl>>Perl >> Version 5.003_97b

Perl>>Perl >> Version 5.003_97c

Perl>>Perl >> Version 5.003_97d

Perl>>Perl >> Version 5.003_97e

Perl>>Perl >> Version 5.003_97f

Perl>>Perl >> Version 5.003_97g

Perl>>Perl >> Version 5.003_97h

Perl>>Perl >> Version 5.003_97i

Perl>>Perl >> Version 5.003_97j

Perl>>Perl >> Version 5.003_98

Perl>>Perl >> Version 5.003_99

Perl>>Perl >> Version 5.003_99a

Perl>>Perl >> Version 5.004

Perl>>Perl >> Version 5.004_01

Perl>>Perl >> Version 5.004_02

Perl>>Perl >> Version 5.004_03

Perl>>Perl >> Version 5.004_04

Perl>>Perl >> Version 5.004_05

Perl>>Perl >> Version 5.005

Perl>>Perl >> Version 5.005_01

Perl>>Perl >> Version 5.005_02

Perl>>Perl >> Version 5.005_03

Perl>>Perl >> Version 5.005_04

Perl>>Perl >> Version 5.6

Perl>>Perl >> Version 5.6.0

Perl>>Perl >> Version 5.6.1

Perl>>Perl >> Version 5.6.2

Perl>>Perl >> Version 5.7.3

Perl>>Perl >> Version 5.8

Perl>>Perl >> Version 5.8.0

Perl>>Perl >> Version 5.8.1

Perl>>Perl >> Version 5.8.2

Perl>>Perl >> Version 5.8.3

Perl>>Perl >> Version 5.8.4

Perl>>Perl >> Version 5.8.5

Perl>>Perl >> Version 5.8.6

Perl>>Perl >> Version 5.8.7

Perl>>Perl >> Version 5.8.8

Perl>>Perl >> Version 5.8.9

Perl>>Perl >> Version 5.8.9

Perl>>Perl >> Version 5.9.0

Perl>>Perl >> Version 5.9.1

Perl>>Perl >> Version 5.9.2

Perl>>Perl >> Version 5.9.3

Perl>>Perl >> Version 5.9.4

Perl>>Perl >> Version 5.9.5

Perl>>Perl >> Version 5.10

Perl>>Perl >> Version 5.10.0

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.11.0

Perl>>Perl >> Version 5.11.1

Perl>>Perl >> Version 5.11.2

Perl>>Perl >> Version 5.11.3

Perl>>Perl >> Version 5.11.4

Perl>>Perl >> Version 5.11.5

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.2

Perl>>Perl >> Version 5.12.2

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.13.0

Perl>>Perl >> Version 5.13.1

Perl>>Perl >> Version 5.13.2

Perl>>Perl >> Version 5.13.3

Perl>>Perl >> Version 5.13.4

Perl>>Perl >> Version 5.13.5

Perl>>Perl >> Version 5.13.6

Perl>>Perl >> Version 5.13.7

Perl>>Perl >> Version 5.13.8

Perl>>Perl >> Version 5.13.9

Perl>>Perl >> Version 5.13.10

Perl>>Perl >> Version 5.13.11

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.1

Perl>>Perl >> Version 5.14.1

Perl>>Perl >> Version 5.14.2

Perl>>Perl >> Version 5.14.2

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.15.0

Perl>>Perl >> Version 5.15.1

Perl>>Perl >> Version 5.15.2

Perl>>Perl >> Version 5.15.3

Perl>>Perl >> Version 5.15.4

Perl>>Perl >> Version 5.15.5

Perl>>Perl >> Version 5.15.6

Perl>>Perl >> Version 5.15.7

Perl>>Perl >> Version 5.15.8

Perl>>Perl >> Version 5.15.9

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.1

Perl>>Perl >> Version 5.16.2

Perl>>Perl >> Version 5.16.3

Perl>>Perl >> Version 5.16.3

Perl>>Perl >> Version 5.17.0

Perl>>Perl >> Version 5.17.1

Perl>>Perl >> Version 5.17.2

Perl>>Perl >> Version 5.17.3

Perl>>Perl >> Version 5.17.4

Perl>>Perl >> Version 5.17.5

Perl>>Perl >> Version 5.17.6

Perl>>Perl >> Version 5.17.7

Perl>>Perl >> Version 5.17.7.0

Perl>>Perl >> Version 5.17.8

Perl>>Perl >> Version 5.17.9

Perl>>Perl >> Version 5.17.10

Perl>>Perl >> Version 5.17.11

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.1

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.4

Perl>>Perl >> Version 5.19.0

Perl>>Perl >> Version 5.19.1

Perl>>Perl >> Version 5.19.2

Perl>>Perl >> Version 5.19.3

Perl>>Perl >> Version 5.19.4

Perl>>Perl >> Version 5.19.5

Perl>>Perl >> Version 5.19.6

Perl>>Perl >> Version 5.19.7

Perl>>Perl >> Version 5.19.8

Perl>>Perl >> Version 5.19.9

Perl>>Perl >> Version 5.19.10

Perl>>Perl >> Version 5.19.11

Perl>>Perl >> Version 5.20.0

Perl>>Perl >> Version 5.20.0

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.2

Perl>>Perl >> Version 5.20.2

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.21.0

Perl>>Perl >> Version 5.21.1

Perl>>Perl >> Version 5.21.2

Perl>>Perl >> Version 5.21.3

Perl>>Perl >> Version 5.21.4

Perl>>Perl >> Version 5.21.5

Perl>>Perl >> Version 5.21.6

Perl>>Perl >> Version 5.21.7

Perl>>Perl >> Version 5.21.8

Perl>>Perl >> Version 5.21.9

Perl>>Perl >> Version 5.21.10

Perl>>Perl >> Version 5.21.11

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.2

Perl>>Perl >> Version 5.22.2

Perl>>Perl >> Version 5.22.3

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.1

Configuraton 0

Opensuse>>Leap >> Version 15.0

Configuraton 0

Apache>>Spamassassin >> Version To (excluding) 3.4.2

Références

https://security.gentoo.org/glsa/201701-75
Tags : vendor-advisory, x_refsource_GENTOO
https://security.gentoo.org/glsa/201812-07
Tags : vendor-advisory, x_refsource_GENTOO
http://www.securitytracker.com/id/1036440
Tags : vdb-entry, x_refsource_SECTRACK
http://www.debian.org/security/2016/dsa-3628
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.securityfocus.com/bid/92136
Tags : vdb-entry, x_refsource_BID