Test ID:	1.3.6.1.4.1.25623.1.0.831401
Category:	Mandrake Local Security Checks
Title:	Mandriva Update for perl MDVSA-2011:091 (perl)
Summary:	The remote host is missing an update for the 'perl'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'perl' package(s) announced via the referenced advisory. Vulnerability Insight: A vulnerability has been found and corrected in perl: The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string (CVE-2011-1487). Packages for 2009.0 are provided as of the Extended Maintenance Program. The updated packages have been patched to correct this issue. Affected Software/OS: perl on Mandriva Linux 2009.0, Mandriva Linux 2009.0/X86_64, Mandriva Linux 2010.1, Mandriva Linux 2010.1/X86_64, Mandriva Enterprise Server 5, Mandriva Enterprise Server 5/X86_64 Solution: Please Install the Updated Packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1487 43921 http://secunia.com/advisories/43921 44168 http://secunia.com/advisories/44168 47124 http://www.securityfocus.com/bid/47124 DSA-2265 http://www.debian.org/security/2011/dsa-2265 FEDORA-2011-4610 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057891.html FEDORA-2011-4631 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057971.html MDVSA-2011:091 http://www.mandriva.com/security/advisories?name=MDVSA-2011:091 SUSE-SR:2011:009 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html [oss-security] 20110401 CVE Request -- perl -- lc(), uc() routines are laundering tainted data http://openwall.com/lists/oss-security/2011/04/01/3 [oss-security] 20110404 Re: CVE Request -- perl -- lc(), uc() routines are laundering tainted data http://openwall.com/lists/oss-security/2011/04/04/35 http://perl5.git.perl.org/perl.git/commit/539689e74a3bcb04d29e4cd9396de91a81045b99 http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336 https://bugzilla.redhat.com/show_bug.cgi?id=692844 https://bugzilla.redhat.com/show_bug.cgi?id=692898 perl-laundering-security-bypass(66528) https://exchange.xforce.ibmcloud.com/vulnerabilities/66528
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.