Remote ACL Bypass Vulnerability in libnet-server-perl Package
Summary
DEBIAN-CVE-2013-1841: Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow remote attackers to bypass ACL restrictions via the hostname parameter. Affects libnet-server-perl versions < 2.013-1. Fixed in 2.013-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libnet-server-perl package is a Perl module that provides a framework for writing server applications. It allows developers to create network servers with ease, handling various protocols and providing features such as multi-threading and connection management. However, it has a vulnerability that arises when the reverse-lookups option is enabled, which can lead to security risks.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2013-1841 occurs when the reverse-lookups option in Net-Server is enabled. It fails to verify if the hostname resolves back to the source IP address, allowing remote attackers to bypass Access Control List (ACL) restrictions. This could lead to unauthorized access to server resources, potentially compromising the integrity and confidentiality of the server's data.
How To Fix
Minimum fixed version
2.013-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libnet-server-perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the reverse-lookups option in your server configuration to mitigate the risk of this vulnerability until you can apply the patch.
Conclusion
The libnet-server-perl package has a vulnerability that allows remote attackers to bypass ACL restrictions when reverse-lookups are enabled. It is crucial to update to the patched version to secure your server. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for libnet-server-perl →
FAQ
The urgency level of this vulnerability is classified as low, but it still poses a risk of unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability could allow attackers to bypass ACL restrictions, leading to unauthorized access to sensitive server resources.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If you cannot update the package right away, consider disabling the reverse-lookups option as a temporary measure to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for libnet-server-perl.
