Lucene search

RootSSV:3226

HistoryApr 28, 2008 - 12:00 a.m.

Perl Unicode “\Q...\E”正则表达式缓冲区溢出漏洞

2008-04-2800:00:00

Root

www.seebug.org

0.01 Low

EPSS

Percentile

81.8%

JSON

BUGTRAQ ID: 28928
CVE(CAN) ID: CVE-2008-1927

Perl是一种免费且功能强大的编程语言。

Perl在处理畸形的正则表达式时存在漏洞，如果用户所提供的正则表达式字符包含在“\Q…\E”结构所保护的变量中的话，则Perl解释器在编译正则表达式时可能会出现缓冲区溢出，导致拒绝服务的情况。

Larry Wall Perl 5.8.8
厂商补丁：

Debian

Debian已经为此发布了一个安全公告（DSA-1556-1）以及相应补丁:
DSA-1556-1：New perl packages fix denial of service
链接：<a href=“http://www.debian.org/security/2008/dsa-1556” target=“_blank”>http://www.debian.org/security/2008/dsa-1556</a>

补丁下载：

Source archives:

<a href=“http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2.dsc” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2.dsc</a>
Size/MD5 checksum: 1033 a76db5d6c1c52e969641f262971d671b
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2.diff.gz” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2.diff.gz</a>
Size/MD5 checksum: 96868 456e57f3e1d3c9ec432175496a646030
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8.orig.tar.gz” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8.orig.tar.gz</a>
Size/MD5 checksum: 12829188 b8c118d4360846829beb30b02a6b91a7

Architecture independent packages:

<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.8.8-7etch2_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.8.8-7etch2_all.deb</a>
Size/MD5 checksum: 2313432 dbbb5c3c64e2384db97b4b487610bc5e
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.8.8-7etch2_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.8.8-7etch2_all.deb</a>
Size/MD5 checksum: 7348546 ed4582d9dede3e6c429d7501c3111e72
<a href=“http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.8.8-7etch2_all.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.8.8-7etch2_all.deb</a>
Size/MD5 checksum: 40980 b0ff6226ffb342f1e2c8c53c32caf5b3

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.8.8-7etch2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.8.8-7etch2_amd64.deb</a>
Size/MD5 checksum: 32800 22480b2f4bded243ae1f621f0fe59fef
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-base_5.8.8-7etch2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-base_5.8.8-7etch2_amd64.deb</a>
Size/MD5 checksum: 808850 61e1d09c98fb1fb5f12483ae9f63ab79
<a href=“http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.8.8-7etch2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.8.8-7etch2_amd64.deb</a>
Size/MD5 checksum: 630448 81613abb6e184e1ff68f673b3b08f3bd
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2_amd64.deb</a>
Size/MD5 checksum: 4238138 f1ecc46e8ea9796aae6c7874c283c57d
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.8.8-7etch2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.8.8-7etch2_amd64.deb</a>
Size/MD5 checksum: 2734908 3ca5eb6e7cc032d82753d33ad83b4a01
<a href=“http://security.debian.org/pool/updates/main/p/perl/libperl5.8_5.8.8-7etch2_amd64.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/libperl5.8_5.8.8-7etch2_amd64.deb</a>
Size/MD5 checksum: 1010 25a444e727fd3a6d204bc6a536dfa30d

arm architecture (ARM)

<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.8.8-7etch2_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.8.8-7etch2_arm.deb</a>
Size/MD5 checksum: 2547782 215f4806d209971c26a9e2512ed167de
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-base_5.8.8-7etch2_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-base_5.8.8-7etch2_arm.deb</a>
Size/MD5 checksum: 759522 2ccda175882dbc65cde4daa434732548
<a href=“http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.8.8-7etch2_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.8.8-7etch2_arm.deb</a>
Size/MD5 checksum: 561950 a2acd57d7f18526aed26b050231154ba
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.8.8-7etch2_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.8.8-7etch2_arm.deb</a>
Size/MD5 checksum: 30340 beae7b26e01fd5b0a4d8b5db515649f0
<a href=“http://security.debian.org/pool/updates/main/p/perl/libperl5.8_5.8.8-7etch2_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/libperl5.8_5.8.8-7etch2_arm.deb</a>
Size/MD5 checksum: 1010 d1e558624e4e24aee24890df02555be5
<a href=“http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2_arm.deb” target=“_blank”>http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch2_arm.deb</a>
Size/MD5 checksum: 3409080 a4b034d2ffc6a29beda68107b2080e01

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

补丁安装方法：

手工安装补丁包：

首先，使用下面的命令来下载补丁软件：

wget url (url是补丁下载链接地址)

然后，使用下面的命令来安装补丁：

dpkg -i file.deb (file是相应的补丁名)

使用apt-get自动安装补丁包：

首先，使用下面的命令更新内部数据库：

apt-get update

然后，使用下面的命令安装更新软件包：

apt-get upgrade


                                                http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=test.pl;att=2;bug=454792

0.01 Low

EPSS

Percentile

81.8%

JSON

Related for SSV:3226

Perl Unicode “\Q...\E”正则表达式缓冲区溢出漏洞

Debian

wget url (url是补丁下载链接地址)

dpkg -i file.deb (file是相应的补丁名)

apt-get update

apt-get upgrade

Related