10

CVE-2008-7319

The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell metacharacters before use of backticks in External.pm, allowing for shell command injection and arbitrary command execution if untrusted input is used.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Net-ping-external Project ≫ Net-ping-external SwPlatformperl Version <= 0.15
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 6.19% 0.926
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

http://matthias.sdfeu.org/devel/net-ping-external-cmd-injection.patch
Patch
Third Party Advisory
Issue Tracking
http://www.openwall.com/lists/oss-security/2017/11/07/4
Patch
Third Party Advisory
Mailing List
Issue Tracking
https://bugs.debian.org/881097
Patch
Third Party Advisory
Issue Tracking
https://rt.cpan.org/Public/Bug/Display.html?id=33230
Third Party Advisory
Issue Tracking