Vulnerability Details : CVE-2013-2145
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
Vulnerability category: Input validationExecute code
Products affected by CVE-2013-2145
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:a:perlmonks:module\:\:signature:*:*:*:*:*:perl:*:*
- cpe:2.3:a:perlmonks:module\:\:signature:0.70:*:*:*:*:perl:*:*
- cpe:2.3:a:perlmonks:module\:\:signature:0.71:*:*:*:*:perl:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-2145
0.38%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-2145
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.4
|
MEDIUM | AV:L/AC:M/Au:N/C:P/I:P/A:P |
3.4
|
6.4
|
NIST |
CWE ids for CVE-2013-2145
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-2145
-
https://bugzilla.redhat.com/show_bug.cgi?id=971096
971096 – (CVE-2013-2145) CVE-2013-2145 perl-Module-Signature: arbitrary code execution when verifying SIGNATURE
-
https://github.com/audreyt/module-signature/commit/cbd06b392a73c63159dc5c20ff5b3c8fc88c4896
* 0.72 with an improved path checker from @fweimer · audreyt/module-signature@cbd06b3 · GitHubExploit;Patch
-
http://www.securityfocus.com/bid/60352
Module::Signature CVE-2013-2145 Local Arbitrary Code Execution Vulnerability
-
http://www.ubuntu.com/usn/USN-1896-1
USN-1896-1: Module::Signature perl module vulnerability | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-updates/2013-07/msg00043.html
openSUSE-SU-2013:1185-1: moderate: perl-Module-Signature
-
http://www.openwall.com/lists/oss-security/2013/06/05/16
oss-security - CVE-2013-2145: perl Module::Signature code execution vulnerability
-
https://github.com/audreyt/module-signature/commit/575f7bd6ba4cc7c92f841e8758f88a131674ebf2
* Version 71 with advisory from @fweimer · audreyt/module-signature@575f7bd · GitHubExploit;Patch
-
http://lists.opensuse.org/opensuse-updates/2013-07/msg00039.html
openSUSE-SU-2013:1178-1: moderate: perl-Module-Signature
Jump to