¡¾Îó²îͨ¸æ¡¿Perl for Windows´úÂëÖ´ÐÐÎó²î£¨CVE-2023-47039£©

Ðû²¼Ê±¼ä 2024-01-03

Ò»¡¢Îó²î¸ÅÊö

Îó²îÃû³Æ

 Perl for Windows´úÂëÖ´ÐÐÎó²î

CVE   ID

CVE-2023-47039

Îó²îÀàÐÍ

»ùÓڶѵĻº³åÇøÒç³ö

·¢Ã÷ʱ¼ä

2024-01-03

Îó²îÆÀ·Ö

7.8

Îó²îÆ·¼¶

¸ßΣ

¹¥»÷ÏòÁ¿

ÍâµØ

ËùÐèȨÏÞ

µÍ

ʹÓÃÄѶÈ

µÍ

Óû§½»»¥

ÎÞ

PoC/EXP

δ֪

ÔÚҰʹÓÃ

δ֪

 

PerlÊÇÒ»ÖÖ¹¦Ð§¸»ºñµÄÅÌËã»ú³ÌÐòÓïÑÔ£¬£¬£¬ £¬£¬£¬£¬¿ÉÒÔÔËÐÐÔÚ¶àÖÖÅÌËã»úƽ̨ÉÏ£¬£¬£¬ £¬£¬£¬£¬ÊÊÓÃÆÕ±é£¬£¬£¬ £¬£¬£¬£¬¿É±»ÓÃÓÚÖÖÖÖʹÃü£¬£¬£¬ £¬£¬£¬£¬°üÀ¨ÏµÍ³ÖÎÀí¡¢Web¿ª·¢¡¢ÍøÂç±à³Ì¡¢GUI¿ª·¢µÈ¡£¡£¡£¡£¡£¡£¡£

2024Äê1ÔÂ3ÈÕ£¬£¬£¬ £¬£¬£¬£¬¼øºÚµ£±£ÍøVSRC¼à²âµ½Perl for WindowsÖÐÐÞ¸´ÁËÒ»¸ö´úÂëÖ´ÐÐÎó²î£¨CVE-2023-47039£©£¬£¬£¬ £¬£¬£¬£¬ÆäCVSSÆÀ·ÖΪ7.8¡£¡£¡£¡£¡£¡£¡£

Perl for Windows ÊÜÓ°Ïì°æ±¾ÖÐÒÀÀµÏµÍ³Â·¾¶ÇéÐαäÁ¿À´²éÕÒ shell (`cmd.exe`) ʱ±£´æÇå¾²ÎÊÌâ¡£¡£¡£¡£¡£¡£¡£µ±ÔËÐÐʹÓà Windows Perl Ú¹ÊÍÆ÷µÄ¿ÉÖ´ÐÐÎļþʱ£¬£¬£¬ £¬£¬£¬£¬Perl »áʵÑéÔÚ²Ù×÷ϵͳÖвéÕÒ²¢Ö´ÐÐ `cmd.exe`£¬£¬£¬ £¬£¬£¬£¬ÓÉÓÚ·¾¶ËÑË÷˳ÐòÎÊÌ⣬£¬£¬ £¬£¬£¬£¬Perl ×î³õÊÇÔÚÄ¿½ñÊÂÇéĿ¼ÖвéÕÒ cmd.exe¡£¡£¡£¡£¡£¡£¡£µÍȨÏÞÍþвÕ߿ɽ«`cmd.exe`·ÅÔÚȨÏÞ½ÏÈõµÄλÖã¨Èç`C:\ProgramData`£©À´Ê¹ÓøÃÎó²î£¬£¬£¬ £¬£¬£¬£¬µ±ÖÎÀíԱʵÑé´ÓÕâЩÊÜÓ°ÏìµÄλÖÃʹÓøÿÉÖ´ÐÐÎļþʱ£¬£¬£¬ £¬£¬£¬£¬¿ÉÒÔÖ´ÐÐí§Òâ´úÂë¡£¡£¡£¡£¡£¡£¡£

 

 

¶þ¡¢Ó°Ïì¹æÄ£

Perl< 5.32.1

 


Èý¡¢Çå¾²²½·¥

3.1 Éý¼¶°æ±¾

ÏÖÔÚ¸ÃÎó²îÒѾ­ÐÞ¸´£¬£¬£¬ £¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿ÉÉý¼¶µ½ÒÔϰ汾»òPerlÄ¿½ñ×îа汾£º

Perl>=5.32.1

ÏÂÔØÁ´½Ó£º

https://www.perl.org/get.html

3.2 ÔÝʱ²½·¥

ÔÝÎÞ¡£¡£¡£¡£¡£¡£¡£

3.3 ͨÓý¨Òé

l  °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬ £¬£¬£¬£¬ïÔ̭ϵͳÎó²î£¬£¬£¬ £¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£¡£¡£

l  ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬ £¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬ £¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬ £¬£¬£¬£¬ïÔÌ­½«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬ £¬£¬£¬£¬ïÔÌ­¹¥»÷Ãæ¡£¡£¡£¡£¡£¡£¡£

l  ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬ £¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£¡£¡£

l  ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬ £¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔ­Ôò£¬£¬£¬ £¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£¡£¡£¡£¡£¡£¡£

l  ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£¡£¡£

3.4 ²Î¿¼Á´½Ó

https://nvd.nist.gov/vuln/detail/CVE-2023-47039

https://access.redhat.com/security/cve/CVE-2023-47039

https://security-tracker.debian.org/tracker/CVE-2023-47039

 

 

ËÄ¡¢°æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

±¸×¢

V1.0

2024-01-03

Ê×´ÎÐû²¼

 

 

Îå¡¢¸½Â¼

5.1 ¼øºÚµ£±£Íø¼ò½é

¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬ £¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬ £¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬ £¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬ £¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´£¬£¬£¬ £¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬ £¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬ £¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£¡£

5.2 ¹ØÓÚ¼øºÚµ£±£Íø

¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬£¬£¬ £¬£¬£¬£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬£¬£¬ £¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£¡£¡£¡£¡£¡£¡£

¹Ø×¢ÎÒÃÇ£º

image.png