Vulnerability CVE-2015-8607

Vulnerability Name:

CVE-2015-8607 (CCN-109763)

Assigned:

2015-12-17

Published:

2016-01-11

Updated:

2020-07-15

Summary:

The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVSS v3 Severity:

7.3 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
6.4 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-20

Vulnerability Consequences:

Bypass Security

References:

Source: CCN
Type: PathTools Web site
Index of /src/RJBS/PathTools-3.62

Source: CONFIRM
Type: UNKNOWN
http://cpansearch.perl.org/src/RJBS/PathTools-3.62/Changes

Source: MITRE
Type: CNA
CVE-2015-8607

Source: FEDORA
Type: UNKNOWN
FEDORA-2016-69e506e02d

Source: FEDORA
Type: UNKNOWN
FEDORA-2016-4ca904238f

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2016:0881

Source: DEBIAN
Type: UNKNOWN
DSA-3441

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: BID
Type: UNKNOWN
80504

Source: CCN
Type: BID-80504
Perl 'File::Spec' module CVE-2015-8607 Security Bypass Vulnerability

Source: SECTRACK
Type: UNKNOWN
1034772

Source: UBUNTU
Type: UNKNOWN
USN-2878-1

Source: CCN
Type: Debian Bug report logs - 810719
perl: CVE-2015-8607: XS File::Spec::canonpath loses taint

Source: XF
Type: UNKNOWN
pathtools-cve20158607-sec-bypass(109763)

Source: CONFIRM
Type: UNKNOWN
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

Source: CONFIRM
Type: Vendor Advisory
https://rt.perl.org/Public/Bug/Display.html?id=126862

Source: GENTOO
Type: UNKNOWN
GLSA-201701-75

Source: MISC
Type: UNKNOWN
https://www.oracle.com/security-alerts/cpujul2020.html

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-8607

Vulnerable Configuration:

Configuration 1:

cpe:/o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:perl:pathtools:*:*:*:*:*:*:*:* (Version <= 3.61)

Configuration 3:

cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:perl:pathtools:3.61:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20158607	V	CVE-2015-8607	2022-09-02
oval:org.cisecurity:def:334	P	DSA-3441-1 -- perl -- security update	2016-02-19
oval:com.ubuntu.precise:def:20158607000	V	CVE-2015-8607 on Ubuntu 12.04 LTS (precise) - medium.	2016-01-13
oval:com.ubuntu.trusty:def:20158607000	V	CVE-2015-8607 on Ubuntu 14.04 LTS (trusty) - medium.	2016-01-13

BACK