Bugzilla – Bug 858243
VUL-1: CVE-2013-7284: perl-PlRPC: pre-auth remote code execution, weak crypto
Last modified: 2024-04-23 13:14:43 UTC
OSS:11837 PlRPC is a Perl module that implements IDL-free RPCs. It is intended for cross-domain applications, but it fails to achieve that goal because it uses Storable, which is known to be insecure when deserializing (thawing) untrusted data. User name and password are transmitted using Storable, so code execution can happen before authentication. The cryptographic hook built into PlRPC is limited: there is no MAC, no reply protection, and there's just a symmetric group key shared by all users. It's not really PlRPC's fault, considering its age. https://rt.cpan.org/Public/Bug/Display.html?id=90474 https://bugzilla.redhat.com/show_bug.cgi?id=1030572 PlRPC mainly lives on because it is a dependency of DBD::Proxy, which is carried around by the DBI module. This might warrant two CVE assignments (one for the Storable-based code execution), and one for the weak crypto. This was first reported in 2013. The patches that exist just document the issues and are not real fixes (for Storable itself, there is only a documentation fix, so this has precedent). CVE-2013-7284 was assigned for the code-execution issue. The weak crypto issue is depending on a possible upstream response. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7284 http://comments.gmane.org/gmane.comp.security.oss.general/11837 https://bugzilla.redhat.com/show_bug.cgi?id=1030572 https://bugzilla.redhat.com/show_bug.cgi?id=1051108
bugbot adjusting priority
Still no upstream fix. The latest release was issued in 2007, so it may take "some" time.
The "fixed" it by documenting the behaviour. We will treat it as VUL-1 for now
No upstream activity since 2007. Red Hat closed this as WONTFIX: https://bugzilla.redhat.com/show_bug.cgi?id=1051108 Debian dropped the package: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=745477
I guess we should drop this from factory, it really is dead for 9 years now.
Drop request has been issued: https://build.opensuse.org/request/show/430518
whats the needinfo. droprequest is fine by us for unmaintained packages.
SUSE-SU-2020:2238-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 858243 CVE References: CVE-2013-7284 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): perl-PlRPC-0.2020-25.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.