CVE-2016-1238 Privilege escalation in n/a
Local attackers can gain privileges by placing a Trojan horse module in the current working directory due to improper path handling in Perl utilities.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1238?
CVE-2016-1238 is a high-severity vulnerability in Debian Debian Linux, published on 2 Aug 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.
Weakness: CWE-264
Which versions are affected by CVE-2016-1238?
It affects 5 products.
Linux distribution packages (5)
amavisd-new SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 2.11.1-6.3.1 |
perl-ExtUtils-MakeMaker openSUSE:Tumbleweed | All versions | 7.64-1.1 |
perl-IO-Compress openSUSE:Tumbleweed | All versions | 2.213.0-1.1 |
perl-MIME-Charset openSUSE:Tumbleweed | All versions | 1.012.2-1.16 |
perl-Test-File openSUSE:Tumbleweed | All versions | 1.448-1.5 |
Products include Apache Spamassassin, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Perl Perl.
How do I fix CVE-2016-1238?
Upgrade to a fixed version.
Is CVE-2016-1238 being exploited?
There is no known exploitation of CVE-2016-1238 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2020-1946 Apache SpamAssassin has an OS Command Injection vulnerability
- CVE-2018-11780 Code injection in Apache SpamAssassin
- CVE-2020-1930 Command injection in Apache SpamAssassin
- CVE-2020-1931 Command injection in Apache SpamAssassin
- CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
Sources
Also known as ALPINE-CVE-2016-1238, DEBIAN-CVE-2016-1238, DLA-584-1, GHSA-hm5v-6984-hfqp, SUSE-SU-2019:0505-1, UBUNTU-CVE-2016-1238 and 6 more.