CVE-2011-1487 Security feature bypass in n/a
Perl's string case functions fail to propagate taint attributes, allowing attackers to bypass taint protection mechanisms via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1487?
CVE-2011-1487 is a medium-severity vulnerability in n/a, published on 11 Apr 2011.
Official description
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Weakness: CWE-264
Which versions are affected by CVE-2011-1487?
It affects 1 product.
Products include Perl Perl.
How do I fix CVE-2011-1487?
Upgrade to a fixed version.
Is CVE-2011-1487 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-1487 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2011-1487, DSA-2265-1, GHSA-j9hm-95rh-8hr5.