Read the docs
TI-2012-04550 Aliases CVE-2012-5377GHSA-64cp-j7mg-j33g

Untrusted search path vulnerability in the installation functionality in ActivePerl…

Priority LOW 29Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Untrusted search path vulnerability in the installation functionality in ActivePerl 5.16.1.1601, when installed in the top-level C:\ directory, allows local users to gain privileges via a Trojan horse DLL in the C:\Perl\Site\bin directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.

Why it matters now

EPSS 0.01267 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:activestate:activeperl:5.16.1.1601:*:*:*:*:*:*:*5.16.1.1601VulnerableActivestate
  • cpe:2.3:a:activestate:activeperl:5.16.1.1601:*:*:*:*:*:*:* Versions 5.16.1.1601 Vulnerable ·Activestate

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-5377
  2. 2026-10-03 Alias added: GHSA-64cp-j7mg-j33g

References

Exploit 1

Other 1

  • TI-2004-00345 Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry… CVSS 2.0HIGH 10.0
  • TI-2001-00778 Buffer overflow in PerlIS.dll in Activestate ActivePerl 5.6.1.629 and earlier allows… CVSS 2.0HIGH 7.5
  • TI-2004-02157 Integer overflow in the duplication operator in ActivePerl allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2006-02764 ActiveState ActivePerl 5.8.8.817 for Windows configures the site/lib directory with… CVSS 2.0MEDIUM 4.6
  • TI-2004-01895 ActivePerl 5.8.x and others, and Larry Wall's Perl 5.6.1 and others, when running on… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences