Activestate ActivePerl 5.16.1.1601 Installation wlbsctrl.dll untrusted search path

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Activestate ActivePerl 5.16.1.1601. Affected by this issue is some unknown functionality in the library wlbsctrl.dll of the component Installation. Performing a manipulation results in untrusted search path. This vulnerability is cataloged as CVE-2012-5377. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Activestate ActivePerl 5.16.1.1601 (Programming Language Software). This affects an unknown functionality in the library wlbsctrl.dll of the component Installation. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Untrusted search path vulnerability in the installation functionality in ActivePerl 5.16.1.1601, when installed in the top-level C:\ directory, allows local users to gain privileges via a Trojan horse DLL in the C:\Perl\Site\bin directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.

The weakness was shared 10/11/2012 (Website). It is possible to read the advisory at htbridge.com. This vulnerability is uniquely identified as CVE-2012-5377 since 10/11/2012. The exploitability is told to be difficult. Attacking locally is a requirement. The successful exploitation needs a authentication. Technical details and a public exploit are known. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370016 (ActivePerl Insecure File Permissions Vulnerability).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (28130) and OSVDB (86177†). The entries VDB-62685, VDB-62684, VDB-62683 and VDB-62682 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Activestate

Name

• ActivePerl

Version

• 5.16.1.1601

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion