The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.

This update fixes the following security issues :

  - 735882: FastCGI: bypass authentication (CVE-2011-2766)

- added FastCGI-fix_deprecated_api.patch: (bnc#735882)     Fixes an issue where CGI.pm received CGI variables from     previous requests. CVE-2011-2766

The MITRE CVE database describes CVE-2011-2766 as :

The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.

A vulnerability has been found and corrected in fcgi :

The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers (CVE-2011-2766).

The updated packages have been patched to correct this issue.

Ferdinand Smit discovered that FCGI, a Perl module for writing FastCGI applications, is incorrectly restoring environment variables of a prior request in subsequent requests. In some cases this may lead to authentication bypasses or worse.

The oldstable distribution (lenny) is not affected by this problem.

This update to the latest upstream version resolves CVE-2011-2766 - stop leaking information across requests when using the deprecated and undocumented old FCGI interface.

This update resolves CVE-2011-2766 and includes several additional fixes. See the upstream [changelog](http://cpansearch.perl.org/src/FLORA/FCGI-0.73/ChangeLog) for further details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to the latest upstream version resolves CVE-2011-2766 - stop leaking information across requests when using the deprecated and undocumented old FCGI interface.

This update resolves CVE-2011-2766.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
78266	Amazon Linux AMI : perl-FCGI (ALAS-2011-5)	Nessus	Amazon Linux Local Security Checks	high
75828	openSUSE Security Update : FastCGI (openSUSE-SU-2012:0004-1)	Nessus	SuSE Local Security Checks	high
75486	openSUSE Security Update : FastCGI (openSUSE-SU-2012:0004-1)	Nessus	SuSE Local Security Checks	high
74516	openSUSE Security Update : FastCGI (openSUSE-2011-102)	Nessus	SuSE Local Security Checks	high
69564	Amazon Linux AMI : perl-FCGI (ALAS-2011-05)	Nessus	Amazon Linux Local Security Checks	high
57428	Mandriva Linux Security Advisory : fcgi (MDVSA-2012:001)	Nessus	Mandriva Local Security Checks	high
56623	Debian DSA-2327-1 : libfcgi-perl - authentication bypass	Nessus	Debian Local Security Checks	high
56368	Fedora 14 : perl-FCGI-0.74-1.fc14 (2011-13236)	Nessus	Fedora Local Security Checks	high
56366	Fedora 15 : perl-FCGI-0.74-1.fc15 (2011-13230)	Nessus	Fedora Local Security Checks	high
56363	Fedora 16 : perl-FCGI-0.74-1.fc16 (2011-13130)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-2766

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high