製品・ソフトウェアに関する情報

JVN脆弱性詳細

Perl 用の Digest モジュールにおける任意のコマンドを実行される脆弱性

Title	Perl 用の Digest モジュールにおける任意のコマンドを実行される脆弱性
Summary	Perl 用の Digest モジュールには、任意のコマンドを実行される脆弱性が存在します。
Possible impacts	攻撃者により、新しいコンストラクタを介して、任意のコマンドを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 13, 2012, midnight
Registration Date	Jan. 17, 2012, 4:37 p.m.
Last Update	Dec. 17, 2012, 4:24 p.m.

CVSS2.0 : 危険
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected System

VMware

VMware ESX 3.5

VMware ESX 4.0

VMware ESX 4.1

VMware ESXi

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-3597	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3597
National Vulnerability Database (NVD)
2	CVE-2011-3597	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3597
SECURITY BLOG
3	CVE-2011-3597 Improper Input Validation vulnerability in Perl	https://blogs.oracle.com/sunsecurity/entry/cve_2011_3597_improper_input

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
CPAN
1	Digest	http://search.cpan.org/dist/Digest/Digest.pm
IBM SECURITY ADVISORY
2	perl_advisory2	http://aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc
Red Hat Security Advisory
3	RHSA-2011:1424	http://www.redhat.com/support/errata/RHSA-2011-1424.html
4	RHSA-2011:1797	http://www.redhat.com/support/errata/RHSA-2011-1797.html
VMware Security Advisories
5	VMSA-2012-0013	http://www.vmware.com/jp/support/support-resources/advisories/VMSA-2012-0013.html

Change Log

No	Changed Details	Date of change
0	[2012年01月17日] 掲載 [2012年07月23日] ベンダ情報：オラクル (CVE-2011-3597 Improper Input Validation vulnerability in Perl) を追加 [2012年12月17日] 影響を受けるシステム：VMware (VMSA-2012-0013) の情報を追加ベンダ情報：VMware (VMSA-2012-0013) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-3597

Summary	Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Publication Date	Jan. 14, 2012, 3:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:30 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:gisle_aas:digest:1.10:::::::*
cpe:2.3:a:gisle_aas:digest:1.03:::::::*
cpe:2.3:a:gisle_aas:digest:1.07:::::::*
cpe:2.3:a:gisle_aas:digest:1.01:::::::*
cpe:2.3:a:gisle_aas:digest:1.16:::::::*
cpe:2.3:a:gisle_aas:digest:1.00:::::::*
cpe:2.3:a:gisle_aas:digest:1.06:::::::*
cpe:2.3:a:gisle_aas:digest:1.11:::::::*
cpe:2.3:a:gisle_aas:digest:1.12:::::::*
cpe:2.3:a:gisle_aas:digest:1.14:::::::*
cpe:2.3:a:gisle_aas:digest:1.09:::::::*
cpe:2.3:a:gisle_aas:digest:1.04:::::::*
cpe:2.3:a:gisle_aas:digest:1.15:::::::*
cpe:2.3:a:gisle_aas:digest:1.13:::::::*
cpe:2.3:a:gisle_aas:digest:1.02:::::::*
cpe:2.3:a:gisle_aas:digest:1.05:::::::*
cpe:2.3:a:gisle_aas:digest:1.08:::::::*

Related information, measures and tools

No	URL	タグ
1	http://aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc
2	http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes
3	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
4	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
5	http://secunia.com/advisories/46279	Vendor Advisory
6	http://secunia.com/advisories/51457
7	http://www.mandriva.com/security/advisories?name=MDVSA-2012:008
8	http://www.mandriva.com/security/advisories?name=MDVSA-2012:009
9	http://www.redhat.com/support/errata/RHSA-2011-1424.html
10	http://www.redhat.com/support/errata/RHSA-2011-1797.html
11	http://www.securityfocus.com/bid/49911
12	http://www.ubuntu.com/usn/USN-1643-1
13	https://bugzilla.redhat.com/show_bug.cgi?id=743010	Patch
14	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19446
15	http://aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc
16	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19446
17	https://bugzilla.redhat.com/show_bug.cgi?id=743010	Patch
18	http://www.ubuntu.com/usn/USN-1643-1
19	http://www.securityfocus.com/bid/49911
20	http://www.redhat.com/support/errata/RHSA-2011-1797.html
21	http://www.redhat.com/support/errata/RHSA-2011-1424.html
22	http://www.mandriva.com/security/advisories?name=MDVSA-2012:009
23	http://www.mandriva.com/security/advisories?name=MDVSA-2012:008
24	http://secunia.com/advisories/51457
25	http://secunia.com/advisories/46279	Vendor Advisory
26	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
27	http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
28	http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:gisle_aas:digest:1.10:::::::*
cpe:2.3:a:gisle_aas:digest:1.03:::::::*
cpe:2.3:a:gisle_aas:digest:1.07:::::::*
cpe:2.3:a:gisle_aas:digest:1.01:::::::*
cpe:2.3:a:gisle_aas:digest:1.16:::::::*
cpe:2.3:a:gisle_aas:digest:1.00:::::::*
cpe:2.3:a:gisle_aas:digest:1.06:::::::*
cpe:2.3:a:gisle_aas:digest:1.11:::::::*
cpe:2.3:a:gisle_aas:digest:1.12:::::::*
cpe:2.3:a:gisle_aas:digest:1.14:::::::*
cpe:2.3:a:gisle_aas:digest:1.09:::::::*
cpe:2.3:a:gisle_aas:digest:1.04:::::::*
cpe:2.3:a:gisle_aas:digest:1.15:::::::*
cpe:2.3:a:gisle_aas:digest:1.13:::::::*
cpe:2.3:a:gisle_aas:digest:1.02:::::::*
cpe:2.3:a:gisle_aas:digest:1.05:::::::*
cpe:2.3:a:gisle_aas:digest:1.08:::::::*