The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell metacharacters before use of backticks in External.pm, allowing for shell command injection and arbitrary command execution if untrusted input is used.
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Link | Tags |
---|---|
https://rt.cpan.org/Public/Bug/Display.html?id=33230 | third party advisory issue tracking |
https://bugs.debian.org/881097 | patch third party advisory issue tracking |
http://www.openwall.com/lists/oss-security/2017/11/07/4 | patch mailing list third party advisory issue tracking |
http://matthias.sdfeu.org/devel/net-ping-external-cmd-injection.patch | patch third party advisory issue tracking |