CVE-2004-2022 ActivePerl 5.8.x and others, and Larry Wall's Perl 5.6.1 and others, when running on Windows systems, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a lo...
LowCVSS 2.1
EPSS 1.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
ActivePerl 5.8.x and others, and Larry Wall's Perl 5.6.1 and others, when running on Windows systems, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to the system command, which leads to a stack-based buffer overflow. NOTE: it is unclear whether this bug is in Perl or the OS API that is used by Perl.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| activestate activeperl | = 5.6.1 | No fix listed |
| activestate activeperl | = 5.6.1.630 | No fix listed |
| activestate activeperl | = 5.6.2 | No fix listed |
| activestate activeperl | = 5.6.3 | No fix listed |
| activestate activeperl | = 5.7.1 | No fix listed |
| activestate activeperl | = 5.7.2 | No fix listed |
| activestate activeperl | = 5.7.3 | No fix listed |
| activestate activeperl | = 5.8 | No fix listed |
References
- 20040518 Re[2]: [Full-Disclosure] Buffer Overflow in ActivePerl ? mailing-list
- 20040518 RE: [Full-Disclosure] Re: Buffer Overflow in ActivePerl ? mailing-list
- 20040517 Buffer Overflow in ActivePerl ? mailing-list
- 20040517 RE: Buffer Overflow in ActivePerl ? mailing-list
- 20040518 Re: Buffer Overflow in ActivePerl ? mailing-list
- www.oliverkarow.de exploit
- www.perlmonks.org exploit
- 10375 exploit vdb-entry
- perl-system-bo(16169) vdb-entry