CVE-2016-1238 : Detail

CVE-2016-1238

7.8
/
Tinggi
0.32%V4
2016-08-02
14h00 +00:00
A01-Broken Access Control
Local
2024-08-05
22h48 +00:00
CVE.org
NVD
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Kelola notifikasi

Deskripsi CVE

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

Informasi CVE

Kelemahan Terkait

CWE-ID Nama Kelemahan Sumber
CWE-264 Category : Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Metrik

Metrik Skor Tingkat keparahan CVSS Vektor Sumber
V3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Local

The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Low

The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

None

The vulnerable system can be exploited without interaction from any user.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.

 nvd@nist.gov
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.
EPSS First.org

Produk yang Disebutkan

Konfigurasi 0

Debian>>Debian_linux >> Version 8.0

Fedoraproject>>Fedora >> Version 23

Fedoraproject>>Fedora >> Version 24

Konfigurasi 0

Perl>>Perl >> Version 1.0.15

Perl>>Perl >> Version 1.0.16

Perl>>Perl >> Version 5.000

Perl>>Perl >> Version 5.000o

Perl>>Perl >> Version 5.001

Perl>>Perl >> Version 5.001n

Perl>>Perl >> Version 5.002

Perl>>Perl >> Version 5.002_01

Perl>>Perl >> Version 5.003

Perl>>Perl >> Version 5.003_01

Perl>>Perl >> Version 5.003_02

Perl>>Perl >> Version 5.003_03

Perl>>Perl >> Version 5.003_04

Perl>>Perl >> Version 5.003_05

Perl>>Perl >> Version 5.003_07

Perl>>Perl >> Version 5.003_08

Perl>>Perl >> Version 5.003_09

Perl>>Perl >> Version 5.003_10

Perl>>Perl >> Version 5.003_11

Perl>>Perl >> Version 5.003_12

Perl>>Perl >> Version 5.003_13

Perl>>Perl >> Version 5.003_14

Perl>>Perl >> Version 5.003_15

Perl>>Perl >> Version 5.003_16

Perl>>Perl >> Version 5.003_17

Perl>>Perl >> Version 5.003_18

Perl>>Perl >> Version 5.003_19

Perl>>Perl >> Version 5.003_20

Perl>>Perl >> Version 5.003_21

Perl>>Perl >> Version 5.003_22

Perl>>Perl >> Version 5.003_23

Perl>>Perl >> Version 5.003_24

Perl>>Perl >> Version 5.003_25

Perl>>Perl >> Version 5.003_26

Perl>>Perl >> Version 5.003_27

Perl>>Perl >> Version 5.003_28

Perl>>Perl >> Version 5.003_90

Perl>>Perl >> Version 5.003_91

Perl>>Perl >> Version 5.003_92

Perl>>Perl >> Version 5.003_93

Perl>>Perl >> Version 5.003_94

Perl>>Perl >> Version 5.003_95

Perl>>Perl >> Version 5.003_96

Perl>>Perl >> Version 5.003_97

Perl>>Perl >> Version 5.003_97a

Perl>>Perl >> Version 5.003_97b

Perl>>Perl >> Version 5.003_97c

Perl>>Perl >> Version 5.003_97d

Perl>>Perl >> Version 5.003_97e

Perl>>Perl >> Version 5.003_97f

Perl>>Perl >> Version 5.003_97g

Perl>>Perl >> Version 5.003_97h

Perl>>Perl >> Version 5.003_97i

Perl>>Perl >> Version 5.003_97j

Perl>>Perl >> Version 5.003_98

Perl>>Perl >> Version 5.003_99

Perl>>Perl >> Version 5.003_99a

Perl>>Perl >> Version 5.004

Perl>>Perl >> Version 5.004_01

Perl>>Perl >> Version 5.004_02

Perl>>Perl >> Version 5.004_03

Perl>>Perl >> Version 5.004_04

Perl>>Perl >> Version 5.004_05

Perl>>Perl >> Version 5.005

Perl>>Perl >> Version 5.005_01

Perl>>Perl >> Version 5.005_02

Perl>>Perl >> Version 5.005_03

Perl>>Perl >> Version 5.005_04

Perl>>Perl >> Version 5.6

Perl>>Perl >> Version 5.6.0

Perl>>Perl >> Version 5.6.1

Perl>>Perl >> Version 5.6.2

Perl>>Perl >> Version 5.7.3

Perl>>Perl >> Version 5.8

Perl>>Perl >> Version 5.8.0

Perl>>Perl >> Version 5.8.1

Perl>>Perl >> Version 5.8.2

Perl>>Perl >> Version 5.8.3

Perl>>Perl >> Version 5.8.4

Perl>>Perl >> Version 5.8.5

Perl>>Perl >> Version 5.8.6

Perl>>Perl >> Version 5.8.7

Perl>>Perl >> Version 5.8.8

Perl>>Perl >> Version 5.8.9

Perl>>Perl >> Version 5.8.9

Perl>>Perl >> Version 5.9.0

Perl>>Perl >> Version 5.9.1

Perl>>Perl >> Version 5.9.2

Perl>>Perl >> Version 5.9.3

Perl>>Perl >> Version 5.9.4

Perl>>Perl >> Version 5.9.5

Perl>>Perl >> Version 5.10

Perl>>Perl >> Version 5.10.0

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.11.0

Perl>>Perl >> Version 5.11.1

Perl>>Perl >> Version 5.11.2

Perl>>Perl >> Version 5.11.3

Perl>>Perl >> Version 5.11.4

Perl>>Perl >> Version 5.11.5

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.2

Perl>>Perl >> Version 5.12.2

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.13.0

Perl>>Perl >> Version 5.13.1

Perl>>Perl >> Version 5.13.2

Perl>>Perl >> Version 5.13.3

Perl>>Perl >> Version 5.13.4

Perl>>Perl >> Version 5.13.5

Perl>>Perl >> Version 5.13.6

Perl>>Perl >> Version 5.13.7

Perl>>Perl >> Version 5.13.8

Perl>>Perl >> Version 5.13.9

Perl>>Perl >> Version 5.13.10

Perl>>Perl >> Version 5.13.11

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.1

Perl>>Perl >> Version 5.14.1

Perl>>Perl >> Version 5.14.2

Perl>>Perl >> Version 5.14.2

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.15.0

Perl>>Perl >> Version 5.15.1

Perl>>Perl >> Version 5.15.2

Perl>>Perl >> Version 5.15.3

Perl>>Perl >> Version 5.15.4

Perl>>Perl >> Version 5.15.5

Perl>>Perl >> Version 5.15.6

Perl>>Perl >> Version 5.15.7

Perl>>Perl >> Version 5.15.8

Perl>>Perl >> Version 5.15.9

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.1

Perl>>Perl >> Version 5.16.2

Perl>>Perl >> Version 5.16.3

Perl>>Perl >> Version 5.16.3

Perl>>Perl >> Version 5.17.0

Perl>>Perl >> Version 5.17.1

Perl>>Perl >> Version 5.17.2

Perl>>Perl >> Version 5.17.3

Perl>>Perl >> Version 5.17.4

Perl>>Perl >> Version 5.17.5

Perl>>Perl >> Version 5.17.6

Perl>>Perl >> Version 5.17.7

Perl>>Perl >> Version 5.17.7.0

Perl>>Perl >> Version 5.17.8

Perl>>Perl >> Version 5.17.9

Perl>>Perl >> Version 5.17.10

Perl>>Perl >> Version 5.17.11

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.1

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.4

Perl>>Perl >> Version 5.19.0

Perl>>Perl >> Version 5.19.1

Perl>>Perl >> Version 5.19.2

Perl>>Perl >> Version 5.19.3

Perl>>Perl >> Version 5.19.4

Perl>>Perl >> Version 5.19.5

Perl>>Perl >> Version 5.19.6

Perl>>Perl >> Version 5.19.7

Perl>>Perl >> Version 5.19.8

Perl>>Perl >> Version 5.19.9

Perl>>Perl >> Version 5.19.10

Perl>>Perl >> Version 5.19.11

Perl>>Perl >> Version 5.20.0

Perl>>Perl >> Version 5.20.0

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.2

Perl>>Perl >> Version 5.20.2

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.21.0

Perl>>Perl >> Version 5.21.1

Perl>>Perl >> Version 5.21.2

Perl>>Perl >> Version 5.21.3

Perl>>Perl >> Version 5.21.4

Perl>>Perl >> Version 5.21.5

Perl>>Perl >> Version 5.21.6

Perl>>Perl >> Version 5.21.7

Perl>>Perl >> Version 5.21.8

Perl>>Perl >> Version 5.21.9

Perl>>Perl >> Version 5.21.10

Perl>>Perl >> Version 5.21.11

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.2

Perl>>Perl >> Version 5.22.2

Perl>>Perl >> Version 5.22.3

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.1

Konfigurasi 0

Opensuse>>Leap >> Version 15.0

Konfigurasi 0

Apache>>Spamassassin >> Version Hingga (tidak termasuk) 3.4.2

Referensi

https://security.gentoo.org/glsa/201701-75
Tags : vendor-advisory, x_refsource_GENTOO
https://security.gentoo.org/glsa/201812-07
Tags : vendor-advisory, x_refsource_GENTOO
http://www.securitytracker.com/id/1036440
Tags : vdb-entry, x_refsource_SECTRACK
http://www.debian.org/security/2016/dsa-3628
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.securityfocus.com/bid/92136
Tags : vdb-entry, x_refsource_BID
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.