CVE-2002-1436

published 2003-04-11

CVE-2002-1436: The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary Perl code via an HTTP POST request.

Priority P3 44 high 7.5 CVSS 2.0

AV N AC L Au N C P I P A P

EXPLOIT

The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary Perl code via an HTTP POST request.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
novell	netware	—	—
novell	netware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url POST /perl/ HTTP/1.0↗

path /perl/↗

snort

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_SERVER perl post attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/perl/"; reference:bugtraq,5520; reference:cve,2002-1436; reference:nessus,11158; classtype:web-application-attack; sid:2101979; rev:8; metadata:created_at 2010_09_23, cve CVE_2002_1436, signature_severity Unknown, updated_at 2024_03_08;)

• → Detect HTTP POST requests targeting the /perl/ URI path on NetWare web servers; this is the specific endpoint exploited to execute arbitrary Perl code. ↗
• → The exploit payload uses Content-Type: application/octet-stream in the POST request to the /perl/ handler — an unusual content type for a Perl CGI endpoint that can aid in distinguishing malicious requests. ↗
• → The exploit response canary string 'daddy' (from 'Whos your daddy') is embedded in the injected Perl payload and returned in the HTTP response body; detecting this string in server responses may indicate successful exploitation. ↗
• → The exploit reads /etc/hosts as a proof-of-concept file read; monitor for POST /perl/ requests followed by responses containing typical /etc/hosts content. ↗

• · Only Perl 5.003 on Novell NetWare 5.1 and NetWare 6 is vulnerable; systems with Perl 5.6 installed are NOT affected by this issue. ↗
• · The exploit's 'Execute Command' operation (arbitrary OS command execution via backticks) was noted as untested at time of publication; file read/write operations were confirmed working. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.