The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.

A vulnerability has been found and corrected in fcgi :

The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers (CVE-2011-2766).

The updated packages have been patched to correct this issue.

- added FastCGI-fix_deprecated_api.patch: (bnc#735882)     Fixes an issue where CGI.pm received CGI variables from     previous requests. CVE-2011-2766

This update to the latest upstream version resolves CVE-2011-2766 - stop leaking information across requests when using the deprecated and undocumented old FCGI interface.

This update resolves CVE-2011-2766.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update to the latest upstream version resolves CVE-2011-2766 - stop leaking information across requests when using the deprecated and undocumented old FCGI interface.

This update resolves CVE-2011-2766 and includes several additional fixes. See the upstream [changelog](http://cpansearch.perl.org/src/FLORA/FCGI-0.73/ChangeLog) for further details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - 735882: FastCGI: bypass authentication (CVE-2011-2766)

Ferdinand Smit discovered that FCGI, a Perl module for writing FastCGI applications, is incorrectly restoring environment variables of a prior request in subsequent requests. In some cases this may lead to authentication bypasses or worse.

The oldstable distribution (lenny) is not affected by this problem.

The MITRE CVE database describes CVE-2011-2766 as :

The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.

ID	Name	Product	Family	Published	Updated	Severity
78266	Amazon Linux AMI : perl-FCGI (ALAS-2011-5)	Nessus	Amazon Linux Local Security Checks	10/12/2014	4/18/2018	high
57428	Mandriva Linux Security Advisory : fcgi (MDVSA-2012:001)	Nessus	Mandriva Local Security Checks	1/3/2012	1/6/2021	high
74516	openSUSE Security Update : FastCGI (openSUSE-2011-102)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	high
56363	Fedora 16 : perl-FCGI-0.74-1.fc16 (2011-13130)	Nessus	Fedora Local Security Checks	10/3/2011	1/11/2021	high
56366	Fedora 15 : perl-FCGI-0.74-1.fc15 (2011-13230)	Nessus	Fedora Local Security Checks	10/3/2011	1/11/2021	high
56368	Fedora 14 : perl-FCGI-0.74-1.fc14 (2011-13236)	Nessus	Fedora Local Security Checks	10/3/2011	1/11/2021	high
75828	openSUSE Security Update : FastCGI (openSUSE-SU-2012:0004-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	high
56623	Debian DSA-2327-1 : libfcgi-perl - authentication bypass	Nessus	Debian Local Security Checks	10/25/2011	1/11/2021	high
69564	Amazon Linux AMI : perl-FCGI (ALAS-2011-05)	Nessus	Amazon Linux Local Security Checks	9/4/2013	1/30/2015	high
75486	openSUSE Security Update : FastCGI (openSUSE-SU-2012:0004-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high