Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761.

SunOS 5.10_x86: Apache 2 mod_perl Perl cgi.
Date this patch was last updated by Sun : Apr/20/11

SunOS 5.10: Apache 2 mod_perl Perl cgi pat.
Date this patch was last updated by Sun : Apr/20/11

The following vulnerabilities have been fixed in perl-CGI-Simple:
CVE-2010-4410 - crlf injection CVE-2010-4411 - incomplete fix for crlf injection

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.
CVE-2010-2761, CVE-2010-4410 and CVE-2010-4411 have been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-201110-03 (Bugzilla: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Bugzilla. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct cross-site scripting attacks, conduct       script insertion and spoofing attacks, hijack the authentication of       arbitrary users, inject arbitrary HTTP headers, obtain access to       arbitrary accounts, disclose the existence of confidential groups and its       names, or inject arbitrary e-mail headers.
    A local attacker could disclose the contents of temporarfy files for       uploaded attachments.
  Workaround :

    There is no known workaround at this time.

It was discovered that the Safe.pm Perl module incorrectly handled Safe::reval and Safe::rdo access restrictions. An attacker could use this flaw to bypass intended restrictions and possibly execute arbitrary code. (CVE-2010-1168, CVE-2010-1447)

It was discovered that the CGI.pm Perl module incorrectly handled certain MIME boundary strings. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-2761, CVE-2010-4411)

It was discovered that the CGI.pm Perl module incorrectly handled newline characters. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-4410)

It was discovered that the lc, lcfirst, uc, and ucfirst functions did not properly apply the taint attribute when processing tainted input.
An attacker could use this flaw to bypass intended restrictions. This issue only affected Ubuntu 8.04 LTS, 10.04 LTS and 10.10.
(CVE-2011-1487).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Some serious security issues were discovered in Bugzilla and have been fixed in 3.4.10 and 3.6.4.

See http://www.bugzilla.org/security/3.2.9/ for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in perl-CGI :

Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors. NOTE: this issue exists because of an incomplete fix for CVE-2010-2761 (CVE-2010-4411).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been upgraded to the latest version (3.51) which is not affected by this issue and in turn also brings many bugfixes.

A Bugzilla Security Advisory reports :

This advisory covers three security issues that have recently been fixed in the Bugzilla code :

- A weakness in Bugzilla could allow a user to gain unauthorized access to another Bugzilla account.

- A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages in Bugzilla.

- If you put a harmful 'javascript:' or 'data:' URL into Bugzilla's 'URL' field, then there are multiple situations in which Bugzilla will unintentionally make that link clickable.

- Various pages lack protection against cross-site request forgeries.

All affected installations are encouraged to upgrade as soon as possible.

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses.

  - have been assigned to this issue. (CVE-2010-2761 /     CVE-2010-4410 / CVE-2010-4411)

Multiple header injection problems in the CGI module of perl have been fixed. They allowed to inject HTTP headers in responses. CVE-2010-2761 / CVE-2010-4410 / CVE-2010-4411 have been assigned to this issue.

The remote web server is hosting Bugzilla, a web-based bug tracking application.

Versions of Bugzilla 3.2.x earlier than 3.2.10, 3.4.x earlier than 3.4.10, and 3.6.x earlier than 3.6.4 are potentially affected by multiple vulnerabilities :

  - A weakness could allow a user to gain unauthorized access to another Bugzilla account.

  - A weakness in the Perl CGI.pm module allows injecting HTTP headers and content to users via several pages.

  - It is possible to insert harmful 'javascript:' or 'data:' URLs into Bugzilla's 'URL' field which in some cases Buzilla will make clickable.

  - Various pages lack protection against cross-site request forgeries.

ID	Name	Product	Family	Severity
108026	Solaris 10 (x86) : 141553-04	Nessus	Solaris Local Security Checks	medium
107527	Solaris 10 (sparc) : 141552-04	Nessus	Solaris Local Security Checks	medium
75709	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0083-1)	Nessus	SuSE Local Security Checks	medium
75705	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	medium
56445	GLSA-201110-03 : Bugzilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
55090	Ubuntu 6.06 LTS / 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : perl vulnerabilities (USN-1129-1)	Nessus	Ubuntu Local Security Checks	high
53791	openSUSE Security Update : perl-CGI-Simple (openSUSE-SU-2011:0083-1)	Nessus	SuSE Local Security Checks	medium
53789	openSUSE Security Update : perl (openSUSE-SU-2011:0064-1)	Nessus	SuSE Local Security Checks	medium
51856	Fedora 13 : bugzilla-3.4.10-1.fc13 (2011-0755)	Nessus	Fedora Local Security Checks	high
51855	Fedora 14 : bugzilla-3.6.4-1.fc14 (2011-0741)	Nessus	Fedora Local Security Checks	high
51800	Mandriva Linux Security Advisory : perl-CGI (MDVSA-2011:008)	Nessus	Mandriva Local Security Checks	medium
51670	FreeBSD : bugzilla -- multiple serious vulnerabilities (c8c927e5-2891-11e0-8f26-00151735203a)	Nessus	FreeBSD Local Security Checks	high
51641	SuSE 10 Security Update : Perl (ZYPP Patch Number 7316)	Nessus	SuSE Local Security Checks	medium
51630	SuSE 11.1 Security Update : perl (SAT Patch Number 3804)	Nessus	SuSE Local Security Checks	medium
5744	Bugzilla < 3.2.10 / 3.4.10 / 3.6.4 Multiple Vulnerabilities	Nessus Network Monitor	CGI	low

Detections

Analytics

CVE-2010-4411

critical

Tenable Plugins

medium

medium

medium

medium

high

high

medium

medium

high

high

medium

high

medium

medium

low