Re: Net::Ping::External command injections

[Salvatore Bonaccorso <carnil () debian org>]

Hi

On Tue, Nov 07, 2017 at 05:51:27PM +0100, Matthias Weckbecker wrote:
> Hi,
>
> Net::Ping::External [0] is prone to command injection vulnerabilities.
>
> The issues are roughly 10 (!) years old [1], but the code is still being
> shipped these days (e.g. in ubuntu artful and debian stretch [2]).
>
> I had contacted the author of the code a few days ago, but obviously did
> not get any reaction.
>
> A patch is available here:
>
>   http://matthias.sdfeu.org/devel/net-ping-external-cmd-injection.patch

This issue has been assinged CVE-2008-7319 by MITRE.

Regards,
Salvatore