This update for apache2-mod_perl to version 2.0.11 fixes the following issues :

Security issue fixed :

  - CVE-2011-2767: Fixed a vulnerability which could have     allowed perl code execution in the context of user     account (bsc#1156944).

Other issue addressed :

  - Restore process name after sv_setpv_mg() call.
    (bsc#1091625)&#9;

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2825 advisory.

    Mod_perl incorporates a Perl interpreter into the Apache web server, such that the Apache HTTP server can     directly execute Perl code.

    Security Fix(es):

    * mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess     (CVE-2011-2767)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This release fixes CVE-2011-2767 vulnerability (an arbitrary Perl code execution in the context of the httpd server) by disabling <Perl> sections in non-server-level configuration.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-2737 advisory.

    [2.0.4-12]
    - Fix CVE-2011-2767 (arbitrary Perl code execution in the context of the user       account via a user-owned .htaccess) (bug #1626272)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

mod_perl2 2.0.11 fixes Arbitrary Perl code execution in the context of the user account via a user-owned .htaccess.

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

This update for apache2-mod_perl fixes the following issues :

Security issue fixed :

CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944).

Other issue addressed: Restore process name after sv_setpv_mg() call.
(bsc#1091625)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2826 advisory.

  - mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess     (CVE-2011-2767)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned     .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl     code for the administrator's control of HTTP request processing without also permitting unprivileged users     to run Perl code in the context of the user account that runs Apache HTTP Server processes.
    (CVE-2011-2767)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2737 advisory.

    Mod_perl incorporates a Perl interpreter into the Apache web server, such that the Apache HTTP server can     directly execute Perl code.

    Security Fix(es):

    * mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess     (CVE-2011-2767)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for mod_perl is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mod_perl incorporates a Perl interpreter into the Apache web server, such that the Apache HTTP server can directly execute Perl code.

Security Fix(es) :

* mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess (CVE-2011-2767)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

mod_perl allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.(CVE-2011-2767)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
131277	openSUSE Security Update : apache2-mod_perl (openSUSE-2019-2549)	Nessus	SuSE Local Security Checks	2019/11/25	2024/4/10	critical
210320	RHEL 7 : rh-perl526-mod_perl (RHSA-2018:2825)	Nessus	Red Hat Local Security Checks	2024/11/5	2024/11/5	critical
117374	Fedora 27 : mod_perl (2018-a94668408d)	Nessus	Fedora Local Security Checks	2018/9/10	2024/8/8	critical
117679	Oracle Linux 6 : mod_perl (ELSA-2018-2737)	Nessus	Oracle Linux Local Security Checks	2018/9/25	2024/10/22	critical
129771	FreeBSD : mod_perl2 -- execute arbitrary Perl code (c360d057-ea8b-11e9-859b-b885849ded8e)	Nessus	FreeBSD Local Security Checks	2019/10/10	2024/4/18	critical
131998	SUSE SLES12 Security Update : apache2-mod_perl (SUSE-SU-2019:3213-1)	Nessus	SuSE Local Security Checks	2019/12/12	2024/4/4	critical
194072	RHEL 6 / 7 : rh-perl524-mod_perl (RHSA-2018:2826)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/4/27	critical
217533	Linux Distros Unpatched Vulnerability : CVE-2011-2767	Nessus	Misc.	2025/3/3	2026/1/28	critical
117681	RHEL 6 : mod_perl (RHSA-2018:2737)	Nessus	Red Hat Local Security Checks	2018/9/25	2024/11/5	critical
117828	CentOS 6 : mod_perl (CESA-2018:2737)	Nessus	CentOS Local Security Checks	2018/10/1	2022/2/24	critical
117922	Amazon Linux AMI : mod_perl / mod24_perl (ALAS-2018-1085)	Nessus	Amazon Linux Local Security Checks	2018/10/5	2022/2/10	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical