CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0558 advisory.

  - The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier     uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows     remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted     input that contains this value, a different vulnerability than CVE-2010-3172. (CVE-2010-2761)

  - CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in     CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP     response splitting attacks via vectors related to non-whitespace characters preceded by newline     characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172. (CVE-2010-4410)

  - The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through     5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing     tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via     a crafted string. (CVE-2011-1487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - Apache Struts
  - glibc
  - GnuTLS
  - JRE
  - kernel
  - libxml2
  - OpenSSL
  - Perl
  - popt and rpm

The following vulnerabilities have been fixed in perl-CGI-Simple:
CVE-2010-4410 - crlf injection CVE-2010-4411 - incomplete fix for crlf injection

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.
CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1797 advisory.

    - CVE-2010-2761 CVE-2010-4410 perl: CGI module multiple issues fixed by security       patch based on commit from version 3.50
    - CVE-2010-2761 CVE-2010-4410 perl: CGI module multiple issues fixed by update       of CGI module to 3.54

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

a. vCenter and ESX update to JRE 1.6.0 Update 31

   The Oracle (Sun) JRE is updated to version 1.6.0_31, which    addresses multiple security issues. Oracle has documented the    CVE identifiers that are addressed by this update in the Oracle    Java SE Critical Patch Update Advisory of February 2012.

b. vCenter Update Manager update to JRE 1.5.0 Update 36

   The Oracle (Sun) JRE is updated to 1.5.0_36 to address multiple    security issues.  Oracle has documented the CVE identifiers that    are addressed in JRE 1.5.0_36 in the Oracle Java SE Critical    Patch Update Advisory for June 2012.

c. Update to ESX/ESXi userworld OpenSSL library

   The ESX/ESXi userworld OpenSSL library is updated from version    0.9.8p to version 0.9.8t to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-4180, CVE-2010-4252,    CVE-2011-0014, CVE-2011-4108, CVE-2011-4109, CVE-2011-4576,    CVE-2011-4577, CVE-2011-4619, and CVE-2012-0050 to these issues.

d. Update to ESX service console OpenSSL RPM

   The service console OpenSSL RPM is updated to version    0.9.8e-22.el5_8.3 to resolve a security issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-2110 to this issue.

e. Update to ESX service console kernel

   The ESX service console kernel is updated to resolve multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2011-1833, CVE-2011-2484,    CVE-2011-2496, CVE-2011-3188, CVE-2011-3209, CVE-2011-3363,    CVE-2011-4110, CVE-2011-1020, CVE-2011-4132, CVE-2011-4324,    CVE-2011-4325, CVE-2012-0207, CVE-2011-2699, and CVE-2012-1583    to these issues.

f. Update to ESX service console Perl RPM

   The ESX service console Perl RPM is updated to    perl-5.8.8.32.1.8999.vmw to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-2761, CVE-2010-4410, and    CVE-2011-3597 to these issues.

g. Update to ESX service console libxml2 RPMs

   The ESX service console libmxl2 RPMs are updated to    libxml2-2.6.26-2.1.15.el5_8.2 and    libxml2-python-2.6.26-2.1.15.el5_8.2 to resolve a security    issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-0841 to this issue.

h. Update to ESX service console glibc RPM

   The ESX service console glibc RPM is updated to version    glibc-2.5-81.el5_8.1 to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)   has assigned the names CVE-2009-5029, CVE-2009-5064,    CVE-2010-0830, CVE-2011-1089, CVE-2011-4609, and CVE-2012-0864    to these issue.

i. Update to ESX service console GnuTLS RPM

   The ESX service console GnuTLS RPM is updated to version    1.4.1-7.el5_8.2 to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2011-4128, CVE-2012-1569, and    CVE-2012-1573 to these issues.

j. Update to ESX service console popt, rpm, rpm-libs,    and rpm-python RPMS

   The ESX service console popt, rpm, rpm-libs, and rpm-python RPMS    are updated to the following versions to resolve multiple    security issues :
      - popt-1.10.2.3-28.el5_8
      - rpm-4.4.2.3-28.el5_8
      - rpm-libs-4.4.2.3-28.el5_8
      - rpm-python-4.4.2.3-28.el5_8

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-0060, CVE-2012-0061, and    CVE-2012-0815 to these issues.

k. Vulnerability in third-party Apache Struts component

   The version of Apache Struts in vCenter Operations has been    updated to 2.3.4 which addresses an arbitrary file overwrite    vulnerability. This vulnerability allows an attacker to create    a denial of service by overwriting arbitrary files without    authentication. The attacker would need to be on the same network    as the system where vCOps is installed.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2012-0393 to this issue.

   Note: Apache struts 2.3.4 addresses the following issues as well :
   CVE-2011-5057, CVE-2012-0391, CVE-2012-0392, CVE-2012-0394. It    was found that these do not affect vCOps.

   VMware would like to thank Alexander Minozhenko from ERPScan for    reporting this issue to us.

Updated perl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Perl is a high-level programming language commonly used for system administration utilities and web programming.

It was found that the 'new' constructor of the Digest module used its argument as part of the string expression passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary Perl code with the privileges of a Perl program that uses untrusted input as an argument to the constructor. (CVE-2011-3597)

It was found that the Perl CGI module used a hard-coded value for the MIME boundary string in multipart/x-mixed-replace content. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially crafted HTTP request. (CVE-2010-2761)

A CRLF injection flaw was found in the way the Perl CGI module processed a sequence of non-whitespace preceded by newline characters in the header. A remote attacker could use this flaw to conduct an HTTP response splitting attack via a specially crafted sequence of characters provided to the CGI module. (CVE-2010-4410)

All Perl users should upgrade to these updated packages, which contain backported patches to correct these issues. All running Perl programs must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1797 advisory.

  - perl-CGI, perl-CGI-Simple: CVE-2010-2761 - hardcoded MIME boundary value for multipart content,     CVE-2010-4410 - CRLF injection allowing HTTP response splitting (CVE-2010-2761, CVE-2010-4410)

  - Perl Digest improper control of generation of code (CVE-2011-3597)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the Safe.pm Perl module incorrectly handled Safe::reval and Safe::rdo access restrictions. An attacker could use this flaw to bypass intended restrictions and possibly execute arbitrary code. (CVE-2010-1168, CVE-2010-1447)

It was discovered that the CGI.pm Perl module incorrectly handled certain MIME boundary strings. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-2761, CVE-2010-4411)

It was discovered that the CGI.pm Perl module incorrectly handled newline characters. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-4410)

It was discovered that the lc, lcfirst, uc, and ucfirst functions did not properly apply the taint attribute when processing tainted input.
An attacker could use this flaw to bypass intended restrictions. This issue only affected Ubuntu 8.04 LTS, 10.04 LTS and 10.10.
(CVE-2011-1487).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0558 advisory.

    Perl is a high-level programming language commonly used for system     administration utilities and web programming. The Perl CGI module provides     resources for preparing and processing Common Gateway Interface (CGI) based     HTTP requests and responses.

    It was found that the Perl CGI module used a hard-coded value for the MIME     boundary string in multipart/x-mixed-replace content. A remote attacker     could possibly use this flaw to conduct an HTTP response splitting attack     via a specially-crafted HTTP request. (CVE-2010-2761)

    A CRLF injection flaw was found in the way the Perl CGI module processed a     sequence of non-whitespace preceded by newline characters in the header. A     remote attacker could use this flaw to conduct an HTTP response splitting     attack via a specially-crafted sequence of characters provided to the CGI     module. (CVE-2010-4410)

    It was found that certain Perl string manipulation functions (such as uc()     and lc()) failed to preserve the taint bit. A remote attacker could use     this flaw to bypass the Perl taint mode protection mechanism in scripts     that use the affected functions to process tainted input. (CVE-2011-1487)

    These packages upgrade the CGI module to version 3.51. Refer to the CGI     module's Changes file, linked to in the References, for a full list of     changes.

    This update also fixes the following bugs:

    * When using the threads module, an attempt to send a signal to a thread     that did not have a signal handler specified caused the perl interpreter to     terminate unexpectedly with a segmentation fault. With this update, the     threads module has been updated to upstream version 1.82, which fixes     this bug. As a result, sending a signal to a thread that does not have the     signal handler specified no longer causes perl to crash. (BZ#626330)

    * Prior to this update, the perl packages did not require the Digest::SHA     module as a dependency. Consequent to this, when a user started the cpan     command line interface and attempted to download a distribution from CPAN,     they may have been presented with the following message:

    CPAN: checksum security checks disabled because Digest::SHA not installed.
    Please consider installing the Digest::SHA module.

    This update corrects the spec file for the perl package to require the     perl-Digest-SHA package as a dependency, and cpan no longer displays the     above message. (BZ#640716)

    * When using the threads module, continual creation and destruction of     threads could cause the Perl program to consume an increasing amount of     memory. With this update, the underlying source code has been corrected to     free the allocated memory when a thread is destroyed, and the continual     creation and destruction of threads in Perl programs no longer leads to     memory leaks. (BZ#640720)

    * Due to a packaging error, the perl packages did not include the     NDBM_File module. This update corrects this error, and NDBM_File is now     included as expected. (BZ#640729)

    * Prior to this update, the prove(1) manual page and the prove --help     command listed --fork as a valid command line option. However, version     3.17 of the Test::Harness distribution removed the support for the     fork-based parallel testing, and the prove utility thus no longer supports     this option. This update corrects both the manual page and the output of     the prove --help command, so that --fork is no longer included in the     list of available command line options. (BZ#609492)

    Users of Perl, especially those of Perl threads, are advised to upgrade to     these updated packages, which correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 1.113 and apply additional patch to resolve CVE-2010-4410.

Fix boundary to use randomized value as opposed to hard-coded value.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.

  - have been assigned to this issue. (CVE-2010-2761 /     CVE-2010-4410 / CVE-2010-4411)

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses. CVE-2010-2761 / CVE-2010-4410 / CVE-2010-4411 have been assigned to this issue.

The remote web server is hosting Bugzilla, a web-based bug tracking application.

Versions of Bugzilla 3.2.x earlier than 3.2.10, 3.4.x earlier than 3.4.10, and 3.6.x earlier than 3.6.4 are potentially affected by multiple vulnerabilities :

  - A weakness could allow a user to gain unauthorized access to another Bugzilla account.

  - A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages.

  - It is possible to insert harmful 'javascript:' or 'data:' URLs into Bugzilla's 'URL' field which in some cases Buzilla will make clickable.

  - Various pages lack protection against cross-site request forgeries.

A new version of the CGI Perl module has been released to CPAN, which fixes several security bugs which directly affect Bugzilla (these two security bugs where first discovered as affecting Bugzilla, then identified as being bugs in CGI.pm itself).

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hard-coded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172 (CVE-2010-2761).

CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172 (CVE-2010-4410).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been upgraded to perl-CGI 3.50 to solve these security issues.

ID	Name	Product	Family	Severity
181090	Oracle Linux 6 : perl (ELSA-2011-0558)	Nessus	Oracle Linux Local Security Checks	critical
89038	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0013) (remote check)	Nessus	Misc.	high
75709	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0083-1)	Nessus	SuSE Local Security Checks	medium
75705	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	medium
68402	Oracle Linux 5 : perl (ELSA-2011-1797)	Nessus	Oracle Linux Local Security Checks	critical
61747	VMSA-2012-0013 : VMware vSphere and vCOps updates to third-party libraries	Nessus	VMware ESX Local Security Checks	critical
57068	CentOS 4 / 5 : perl (CESA-2011:1797)	Nessus	CentOS Local Security Checks	high
57053	RHEL 4 / 5 : perl (RHSA-2011:1797)	Nessus	Red Hat Local Security Checks	critical
55090	Ubuntu 6.06 LTS / 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : perl vulnerabilities (USN-1129-1)	Nessus	Ubuntu Local Security Checks	high
54593	RHEL 6 : perl (RHSA-2011:0558)	Nessus	Red Hat Local Security Checks	critical
53791	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0083-1)	Nessus	SuSE Local Security Checks	medium
53789	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	medium
51823	Fedora 14 : perl-CGI-Simple-1.113-1.fc14 (2011-0653)	Nessus	Fedora Local Security Checks	medium
51822	Fedora 13 : perl-CGI-Simple-1.113-1.fc13 (2011-0631)	Nessus	Fedora Local Security Checks	medium
51641	SuSE 10 Security Update : Perl (ZYPP Patch Number 7316)	Nessus	SuSE Local Security Checks	medium
51630	SuSE 11.1 Security Update : perl (SAT Patch Number 3804)	Nessus	SuSE Local Security Checks	medium
5744	Bugzilla < 3.2.10 / 3.4.10 / 3.6.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	low
50609	Mandriva Linux Security Advisory : perl-CGI (MDVSA-2010:237)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-4410

critical

Tenable Plugins

critical

high

medium

medium

critical

critical

high

critical

high

critical

medium

medium

medium

medium

medium

medium

low

medium