¡¾Îó²îͨ¸æ¡¿Perl for Windows´úÂëÖ´ÐÐÎó²î£¨CVE-2023-47039£©
Ðû²¼Ê±¼ä 2024-01-03Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | Perl for Windows´úÂëÖ´ÐÐÎó²î | ||
CVE ID | CVE-2023-47039 | ||
Îó²îÀàÐÍ | »ùÓڶѵĻº³åÇøÒç³ö | ·¢Ã÷ʱ¼ä | 2024-01-03 |
Îó²îÆÀ·Ö | 7.8 | Îó²îÆ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍâµØ | ËùÐèȨÏÞ | µÍ |
ʹÓÃÄÑ¶È | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ֪ | ÔÚҰʹÓà | δ֪ |
PerlÊÇÒ»ÖÖ¹¦Ð§¸»ºñµÄÅÌËã»ú³ÌÐòÓïÑÔ£¬£¬£¬£¬£¬£¬£¬¿ÉÒÔÔËÐÐÔÚ¶àÖÖÅÌËã»úƽ̨ÉÏ£¬£¬£¬£¬£¬£¬£¬ÊÊÓÃÆÕ±é£¬£¬£¬£¬£¬£¬£¬¿É±»ÓÃÓÚÖÖÖÖʹÃü£¬£¬£¬£¬£¬£¬£¬°üÀ¨ÏµÍ³ÖÎÀí¡¢Web¿ª·¢¡¢ÍøÂç±à³Ì¡¢GUI¿ª·¢µÈ¡£¡£¡£¡£¡£¡£¡£
2024Äê1ÔÂ3ÈÕ£¬£¬£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøVSRC¼à²âµ½Perl for WindowsÖÐÐÞ¸´ÁËÒ»¸ö´úÂëÖ´ÐÐÎó²î£¨CVE-2023-47039£©£¬£¬£¬£¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ7.8¡£¡£¡£¡£¡£¡£¡£
Perl for Windows ÊÜÓ°Ïì°æ±¾ÖÐÒÀÀµÏµÍ³Â·¾¶ÇéÐαäÁ¿À´²éÕÒ shell (`cmd.exe`) ʱ±£´æÇå¾²ÎÊÌâ¡£¡£¡£¡£¡£¡£¡£µ±ÔËÐÐʹÓà Windows Perl Ú¹ÊÍÆ÷µÄ¿ÉÖ´ÐÐÎļþʱ£¬£¬£¬£¬£¬£¬£¬Perl »áʵÑéÔÚ²Ù×÷ϵͳÖвéÕÒ²¢Ö´ÐÐ `cmd.exe`£¬£¬£¬£¬£¬£¬£¬ÓÉÓÚ·¾¶ËÑË÷˳ÐòÎÊÌ⣬£¬£¬£¬£¬£¬£¬Perl ×î³õÊÇÔÚÄ¿½ñÊÂÇéĿ¼ÖвéÕÒ cmd.exe¡£¡£¡£¡£¡£¡£¡£µÍȨÏÞÍþвÕ߿ɽ«`cmd.exe`·ÅÔÚȨÏÞ½ÏÈõµÄλÖã¨Èç`C:\ProgramData`£©À´Ê¹ÓøÃÎó²î£¬£¬£¬£¬£¬£¬£¬µ±ÖÎÀíԱʵÑé´ÓÕâЩÊÜÓ°ÏìµÄλÖÃʹÓøÿÉÖ´ÐÐÎļþʱ£¬£¬£¬£¬£¬£¬£¬¿ÉÒÔÖ´ÐÐí§Òâ´úÂë¡£¡£¡£¡£¡£¡£¡£
¶þ¡¢Ó°Ïì¹æÄ£
Perl< 5.32.1
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÏÖÔÚ¸ÃÎó²îÒѾÐÞ¸´£¬£¬£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔϰ汾»òPerlÄ¿½ñ×îа汾£º
Perl>=5.32.1
ÏÂÔØÁ´½Ó£º
https://www.perl.org/get.html
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£¡£¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
l °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬£¬£¬ïÔÌϵͳÎó²î£¬£¬£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£¡£¡£
l ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬£¬£¬ïÔ̽«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬£¬£¬ïÔ̹¥»÷Ãæ¡£¡£¡£¡£¡£¡£¡£
l ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£¡£¡£
l ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬£¬£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£¡£¡£¡£¡£¡£¡£
l ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://nvd.nist.gov/vuln/detail/CVE-2023-47039
https://access.redhat.com/security/cve/CVE-2023-47039
https://security-tracker.debian.org/tracker/CVE-2023-47039
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-01-03 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬£¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£¡£
5.2 ¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬£¬£¬£¬£¬£¬£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬£¬£¬£¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£¡£¡£¡£¡£¡£¡£
¹Ø×¢ÎÒÃÇ£º