Executive Summary

This vulnerability exists in Net::CIDR::Lite versions before 0.24 for Perl. The issue is that the software does not properly handle extraneous zero characters in CIDR mask values. For example, mask forms like "/00" and "/01" are incorrectly accepted as valid and parse to the same prefix as their unpadded counterparts. This improper validation can lead to an IP Access Control List (ACL) bypass.

Useful 0 Not Useful 0

Impact Analysis

Because the vulnerability allows IP ACL bypass, an attacker could potentially circumvent network access restrictions that rely on CIDR mask validation. This could lead to unauthorized access to systems or resources that are supposed to be protected by IP-based ACLs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper validation of zero-padded CIDR mask values in Net::CIDR::Lite versions before 0.24, which may allow IP ACL bypass. Detection would involve identifying usage of vulnerable Net::CIDR::Lite versions in your Perl environment and checking for CIDR mask values with extraneous zero characters such as "/00" or "/01" in ACL configurations.

Since the vulnerability is related to parsing CIDR masks, you can search your system or network configuration files or scripts for CIDR masks with leading zeros in the mask portion.

• Use grep or similar tools to find CIDR masks with zero-padded masks, e.g.: grep -rE '/0[0-9]+' /path/to/configs
• Check the installed version of Net::CIDR::Lite in your Perl environment: perl -MNet::CIDR::Lite -e 'print $Net::CIDR::Lite::VERSION . "\n";'

If the version is before 0.24, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update Net::CIDR::Lite to version 0.24 or later, which includes a patch that properly validates CIDR mask values and rejects zero-padded masks.

If updating is not immediately possible, review and sanitize all CIDR mask inputs in your ACL configurations and scripts to ensure no zero-padded masks like "/00" or "/01" are used.

Apply the patch referenced in Resource 2 if you maintain your own version of Net::CIDR::Lite.

Useful 0 Not Useful 0