CVE-2013-2145

Published: Aug 19, 2013Modified: Apr 29, 2026

4.4

Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 3.4 / Impact: 6.4

Source: NVD

Description

The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.

Affected (9)

Products: Canonical: Ubuntu Linux · Opensuse: Opensuse · Perlmonks: Module\

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 12.10
Canonical Ubuntu Linux	Version 13.04

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 12.2
Opensuse Opensuse	Version 12.3

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Perlmonks Module\	Up to 0.72
Perlmonks Module\	Version \ signature
Perlmonks Module\	Version \ signature

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

http://lists.opensuse.org/opensuse-updates/2013-07/msg00039.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-07/msg00043.html

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2013/06/05/16

Source: secalert@redhat.com

http://www.securityfocus.com/bid/60352

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1896-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=971096

Source: secalert@redhat.com

https://github.com/audreyt/module-signature/commit/575f7bd6ba4cc7c92f841e8758f88a131674ebf2

Source: secalert@redhat.com

ExploitPatch

https://github.com/audreyt/module-signature/commit/cbd06b392a73c63159dc5c20ff5b3c8fc88c4896

Source: secalert@redhat.com

ExploitPatch

http://lists.opensuse.org/opensuse-updates/2013-07/msg00039.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-07/msg00043.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2013/06/05/16

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/60352

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1896-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=971096

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/audreyt/module-signature/commit/575f7bd6ba4cc7c92f841e8758f88a131674ebf2

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://github.com/audreyt/module-signature/commit/cbd06b392a73c63159dc5c20ff5b3c8fc88c4896

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.