SunOS 5.10: Apache 2 mod_perl Perl cgi pat.
Date this patch was last updated by Sun : Apr/20/11

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.

  - have been assigned to this issue. (CVE-2010-2761 /     CVE-2010-4410 / CVE-2010-4411)

A Bugzilla Security Advisory reports :

This advisory covers three security issues that have recently been fixed in the Bugzilla code :

- A weakness in Bugzilla could allow a user to gain unauthorized access to another Bugzilla account.

- A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages in Bugzilla.

- If you put a harmful 'javascript:' or 'data:' URL into Bugzilla's 'URL' field, then there are multiple situations in which Bugzilla will unintentionally make that link clickable.

- Various pages lack protection against cross-site request forgeries.

All affected installations are encouraged to upgrade as soon as possible.

Some serious security issues were discovered in Bugzilla and have been fixed in 3.4.10 and 3.6.4.

See http://www.bugzilla.org/security/3.2.9/ for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.
CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue.

The following vulnerabilities have been fixed in perl-CGI-Simple:
CVE-2010-4410 - crlf injection CVE-2010-4411 - incomplete fix for crlf injection

It was discovered that the Safe.pm Perl module incorrectly handled Safe::reval and Safe::rdo access restrictions. An attacker could use this flaw to bypass intended restrictions and possibly execute arbitrary code. (CVE-2010-1168, CVE-2010-1447)

It was discovered that the CGI.pm Perl module incorrectly handled certain MIME boundary strings. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-2761, CVE-2010-4411)

It was discovered that the CGI.pm Perl module incorrectly handled newline characters. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-4410)

It was discovered that the lc, lcfirst, uc, and ucfirst functions did not properly apply the taint attribute when processing tainted input.
An attacker could use this flaw to bypass intended restrictions. This issue only affected Ubuntu 8.04 LTS, 10.04 LTS and 10.10.
(CVE-2011-1487).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
107527	Solaris 10 (sparc) : 141552-04	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/23	medium
51641	SuSE 10 Security Update : Perl (ZYPP Patch Number 7316)	Nessus	SuSE Local Security Checks	2011/1/21	2021/1/19	medium
51670	FreeBSD : bugzilla -- multiple serious vulnerabilities (c8c927e5-2891-11e0-8f26-00151735203a)	Nessus	FreeBSD Local Security Checks	2011/1/26	2021/1/6	high
51855	Fedora 14 : bugzilla-3.6.4-1.fc14 (2011-0741)	Nessus	Fedora Local Security Checks	2011/2/3	2021/1/11	high
53789	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	medium
53791	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0083-1)	Nessus	SuSE Local Security Checks	2011/5/5	2021/1/14	medium
55090	Ubuntu 6.06 LTS / 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : perl vulnerabilities (USN-1129-1)	Nessus	Ubuntu Local Security Checks	2011/6/13	2019/9/19	high

检测

插件搜索

medium

medium

high

high

medium

medium

high