CVE-2016-1238 : Chi tiết

CVE-2016-1238

7.8
/
Cao
0.32%V4
2016-08-02
14h00 +00:00
A01-Broken Access Control
Local
2024-08-05
22h48 +00:00
CVE.org
NVD
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Quản lý thông báo

Mô tả CVE

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

Thông tin CVE

Điểm yếu liên quan

CWE-ID Tên điểm yếu Nguồn
CWE-264 Category : Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Số liệu

Số liệu Điểm Mức độ nghiêm trọng CVSS Vector Nguồn
V3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Local

The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities.

Attack Complexity

This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

Low

The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.

User Interaction

This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.

None

The vulnerable system can be exploited without interaction from any user.

Base: Scope Metrics

The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

Scope

Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.

Unchanged

An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.

Base: Impact Metrics

The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.

Environmental Metrics

These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.

 nvd@nist.gov
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS là mô hình tính điểm dự đoán khả năng một lỗ hổng bị khai thác.

Điểm EPSS

Mô hình EPSS tạo ra điểm xác suất từ 0 đến 1 (0 đến 100%). Điểm càng cao, xác suất một lỗ hổng bị khai thác càng lớn.

Phân vị EPSS

Phân vị được dùng để xếp hạng CVE theo điểm EPSS. Ví dụ, một CVE ở phân vị thứ 95 theo điểm EPSS có nhiều khả năng bị khai thác hơn 95% CVE khác. Do đó, phân vị được dùng để so sánh điểm EPSS của một CVE với các CVE khác.
EPSS First.org

Sản phẩm được đề cập

Cấu hình 0

Debian>>Debian_linux >> Version 8.0

Fedoraproject>>Fedora >> Version 23

Fedoraproject>>Fedora >> Version 24

Cấu hình 0

Perl>>Perl >> Version 1.0.15

Perl>>Perl >> Version 1.0.16

Perl>>Perl >> Version 5.000

Perl>>Perl >> Version 5.000o

Perl>>Perl >> Version 5.001

Perl>>Perl >> Version 5.001n

Perl>>Perl >> Version 5.002

Perl>>Perl >> Version 5.002_01

Perl>>Perl >> Version 5.003

Perl>>Perl >> Version 5.003_01

Perl>>Perl >> Version 5.003_02

Perl>>Perl >> Version 5.003_03

Perl>>Perl >> Version 5.003_04

Perl>>Perl >> Version 5.003_05

Perl>>Perl >> Version 5.003_07

Perl>>Perl >> Version 5.003_08

Perl>>Perl >> Version 5.003_09

Perl>>Perl >> Version 5.003_10

Perl>>Perl >> Version 5.003_11

Perl>>Perl >> Version 5.003_12

Perl>>Perl >> Version 5.003_13

Perl>>Perl >> Version 5.003_14

Perl>>Perl >> Version 5.003_15

Perl>>Perl >> Version 5.003_16

Perl>>Perl >> Version 5.003_17

Perl>>Perl >> Version 5.003_18

Perl>>Perl >> Version 5.003_19

Perl>>Perl >> Version 5.003_20

Perl>>Perl >> Version 5.003_21

Perl>>Perl >> Version 5.003_22

Perl>>Perl >> Version 5.003_23

Perl>>Perl >> Version 5.003_24

Perl>>Perl >> Version 5.003_25

Perl>>Perl >> Version 5.003_26

Perl>>Perl >> Version 5.003_27

Perl>>Perl >> Version 5.003_28

Perl>>Perl >> Version 5.003_90

Perl>>Perl >> Version 5.003_91

Perl>>Perl >> Version 5.003_92

Perl>>Perl >> Version 5.003_93

Perl>>Perl >> Version 5.003_94

Perl>>Perl >> Version 5.003_95

Perl>>Perl >> Version 5.003_96

Perl>>Perl >> Version 5.003_97

Perl>>Perl >> Version 5.003_97a

Perl>>Perl >> Version 5.003_97b

Perl>>Perl >> Version 5.003_97c

Perl>>Perl >> Version 5.003_97d

Perl>>Perl >> Version 5.003_97e

Perl>>Perl >> Version 5.003_97f

Perl>>Perl >> Version 5.003_97g

Perl>>Perl >> Version 5.003_97h

Perl>>Perl >> Version 5.003_97i

Perl>>Perl >> Version 5.003_97j

Perl>>Perl >> Version 5.003_98

Perl>>Perl >> Version 5.003_99

Perl>>Perl >> Version 5.003_99a

Perl>>Perl >> Version 5.004

Perl>>Perl >> Version 5.004_01

Perl>>Perl >> Version 5.004_02

Perl>>Perl >> Version 5.004_03

Perl>>Perl >> Version 5.004_04

Perl>>Perl >> Version 5.004_05

Perl>>Perl >> Version 5.005

Perl>>Perl >> Version 5.005_01

Perl>>Perl >> Version 5.005_02

Perl>>Perl >> Version 5.005_03

Perl>>Perl >> Version 5.005_04

Perl>>Perl >> Version 5.6

Perl>>Perl >> Version 5.6.0

Perl>>Perl >> Version 5.6.1

Perl>>Perl >> Version 5.6.2

Perl>>Perl >> Version 5.7.3

Perl>>Perl >> Version 5.8

Perl>>Perl >> Version 5.8.0

Perl>>Perl >> Version 5.8.1

Perl>>Perl >> Version 5.8.2

Perl>>Perl >> Version 5.8.3

Perl>>Perl >> Version 5.8.4

Perl>>Perl >> Version 5.8.5

Perl>>Perl >> Version 5.8.6

Perl>>Perl >> Version 5.8.7

Perl>>Perl >> Version 5.8.8

Perl>>Perl >> Version 5.8.9

Perl>>Perl >> Version 5.8.9

Perl>>Perl >> Version 5.9.0

Perl>>Perl >> Version 5.9.1

Perl>>Perl >> Version 5.9.2

Perl>>Perl >> Version 5.9.3

Perl>>Perl >> Version 5.9.4

Perl>>Perl >> Version 5.9.5

Perl>>Perl >> Version 5.10

Perl>>Perl >> Version 5.10.0

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.10.1

Perl>>Perl >> Version 5.11.0

Perl>>Perl >> Version 5.11.1

Perl>>Perl >> Version 5.11.2

Perl>>Perl >> Version 5.11.3

Perl>>Perl >> Version 5.11.4

Perl>>Perl >> Version 5.11.5

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.0

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.1

Perl>>Perl >> Version 5.12.2

Perl>>Perl >> Version 5.12.2

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.3

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.4

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.12.5

Perl>>Perl >> Version 5.13.0

Perl>>Perl >> Version 5.13.1

Perl>>Perl >> Version 5.13.2

Perl>>Perl >> Version 5.13.3

Perl>>Perl >> Version 5.13.4

Perl>>Perl >> Version 5.13.5

Perl>>Perl >> Version 5.13.6

Perl>>Perl >> Version 5.13.7

Perl>>Perl >> Version 5.13.8

Perl>>Perl >> Version 5.13.9

Perl>>Perl >> Version 5.13.10

Perl>>Perl >> Version 5.13.11

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.0

Perl>>Perl >> Version 5.14.1

Perl>>Perl >> Version 5.14.1

Perl>>Perl >> Version 5.14.2

Perl>>Perl >> Version 5.14.2

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.3

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.14.4

Perl>>Perl >> Version 5.15.0

Perl>>Perl >> Version 5.15.1

Perl>>Perl >> Version 5.15.2

Perl>>Perl >> Version 5.15.3

Perl>>Perl >> Version 5.15.4

Perl>>Perl >> Version 5.15.5

Perl>>Perl >> Version 5.15.6

Perl>>Perl >> Version 5.15.7

Perl>>Perl >> Version 5.15.8

Perl>>Perl >> Version 5.15.9

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.0

Perl>>Perl >> Version 5.16.1

Perl>>Perl >> Version 5.16.2

Perl>>Perl >> Version 5.16.3

Perl>>Perl >> Version 5.16.3

Perl>>Perl >> Version 5.17.0

Perl>>Perl >> Version 5.17.1

Perl>>Perl >> Version 5.17.2

Perl>>Perl >> Version 5.17.3

Perl>>Perl >> Version 5.17.4

Perl>>Perl >> Version 5.17.5

Perl>>Perl >> Version 5.17.6

Perl>>Perl >> Version 5.17.7

Perl>>Perl >> Version 5.17.7.0

Perl>>Perl >> Version 5.17.8

Perl>>Perl >> Version 5.17.9

Perl>>Perl >> Version 5.17.10

Perl>>Perl >> Version 5.17.11

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.0

Perl>>Perl >> Version 5.18.1

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.2

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.3

Perl>>Perl >> Version 5.18.4

Perl>>Perl >> Version 5.19.0

Perl>>Perl >> Version 5.19.1

Perl>>Perl >> Version 5.19.2

Perl>>Perl >> Version 5.19.3

Perl>>Perl >> Version 5.19.4

Perl>>Perl >> Version 5.19.5

Perl>>Perl >> Version 5.19.6

Perl>>Perl >> Version 5.19.7

Perl>>Perl >> Version 5.19.8

Perl>>Perl >> Version 5.19.9

Perl>>Perl >> Version 5.19.10

Perl>>Perl >> Version 5.19.11

Perl>>Perl >> Version 5.20.0

Perl>>Perl >> Version 5.20.0

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.1

Perl>>Perl >> Version 5.20.2

Perl>>Perl >> Version 5.20.2

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.20.3

Perl>>Perl >> Version 5.21.0

Perl>>Perl >> Version 5.21.1

Perl>>Perl >> Version 5.21.2

Perl>>Perl >> Version 5.21.3

Perl>>Perl >> Version 5.21.4

Perl>>Perl >> Version 5.21.5

Perl>>Perl >> Version 5.21.6

Perl>>Perl >> Version 5.21.7

Perl>>Perl >> Version 5.21.8

Perl>>Perl >> Version 5.21.9

Perl>>Perl >> Version 5.21.10

Perl>>Perl >> Version 5.21.11

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.0

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.1

Perl>>Perl >> Version 5.22.2

Perl>>Perl >> Version 5.22.2

Perl>>Perl >> Version 5.22.3

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.0

Perl>>Perl >> Version 5.24.1

Cấu hình 0

Opensuse>>Leap >> Version 15.0

Cấu hình 0

Apache>>Spamassassin >> Version Đến (không bao gồm) 3.4.2

Tài liệu tham khảo

https://security.gentoo.org/glsa/201701-75
Tags : vendor-advisory, x_refsource_GENTOO
https://security.gentoo.org/glsa/201812-07
Tags : vendor-advisory, x_refsource_GENTOO
http://www.securitytracker.com/id/1036440
Tags : vdb-entry, x_refsource_SECTRACK
http://www.debian.org/security/2016/dsa-3628
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.securityfocus.com/bid/92136
Tags : vdb-entry, x_refsource_BID
Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.