CVE-2010-4777

Perl - Denial of Service via Crafted Regular Expression Input

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-4777. PoCs published by Vladimir Perepelitsa.

AI-analyzed exploit summary This Perl script exploits CVE-2010-4777, a denial-of-service vulnerability in Perl's regular expression handling. It triggers a crash by manipulating UTF-8 strings and regex patterns, causing the application to abort.

Description

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Vladimir Perepelitsa · perldosmultiple

https://www.exploit-db.com/exploits/35489

View Code ZIP pw:eip

This Perl script exploits CVE-2010-4777, a denial-of-service vulnerability in Perl's regular expression handling. It triggers a crash by manipulating UTF-8 strings and regex patterns, causing the application to abort.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: Perl (versions affected by CVE-2010-4777)

No auth needed

Prerequisites: Perl environment vulnerable to CVE-2010-4777

MITRE ATT&CK