Summaryinfo

A vulnerability has been found in Activestate ActivePerl 5.16.1.1601 and classified as problematic. This vulnerability affects unknown code in the library wlbsctrl.dll of the component Installation. The manipulation leads to untrusted search path. This vulnerability was named CVE-2012-5377. There is no exploit available. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability, which was classified as critical, was found in Activestate ActivePerl 5.16.1.1601 (Programming Language Software). This affects an unknown functionality in the library wlbsctrl.dll of the component Installation. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Untrusted search path vulnerability in the installation functionality in ActivePerl 5.16.1.1601, when installed in the top-level C:\ directory, allows local users to gain privileges via a Trojan horse DLL in the C:\Perl\Site\bin directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.

The weakness was shared 10/11/2012 (Website). It is possible to read the advisory at htbridge.com. This vulnerability is uniquely identified as CVE-2012-5377 since 10/11/2012. The exploitability is told to be difficult. Attacking locally is a requirement. The successful exploitation needs a authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 370016 (ActivePerl Insecure File Permissions Vulnerability).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at OSVDB (86177†). The entries VDB-62685, VDB-62684, VDB-62683 and VDB-62682 are related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Activestate

Name

• ActivePerl

Version

• 5.16.1.1601

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion