CVE-2007-1349 PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial...
MediumCVSS 5.0
EPSS 10.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache mod perl | < 1.30 | 1.30 |
| apache mod perl | >= 2.0.0, <= 2.0.11 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 6.10 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| redhat satellite | = 5.1 | No fix listed |
| redhat enterprise linux desktop | = 3.0 | No fix listed |
| redhat enterprise linux desktop | = 4.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux eus | = 4.5 | No fix listed |
| redhat enterprise linux server | = 3.0 | No fix listed |
| redhat enterprise linux server | = 4.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 3.0 | No fix listed |
| redhat enterprise linux workstation | = 4.0 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| debian/libapache2-mod-perl2(Debian:12) | < 2.0.2-5 | 2.0.2-5 |
| debian/libapache2-mod-perl2(Debian:13) | < 2.0.2-5 | 2.0.2-5 |
| debian/libapache2-mod-perl2(Debian:14) | < 2.0.2-5 | 2.0.2-5 |
References
- RHSA-2007:0395 third-party-advisory vendor-advisory
- RHSA-2008:0630 third-party-advisory vendor-advisory
- 24678 third-party-advisory
- 24839 third-party-advisory
- 25072 third-party-advisory
- 25110 third-party-advisory
- 25432 third-party-advisory
- 25655 third-party-advisory
- 25730 third-party-advisory
- 25894 third-party-advisory
- 26084 third-party-advisory
- 26231 third-party-advisory
- 26290 third-party-advisory
- 31490 third-party-advisory
- 31493 third-party-advisory
- 33720 third-party-advisory
- 33723 third-party-advisory
- GLSA-200705-04 third-party-advisory vendor-advisory
- 248386 broken-link vendor-advisory
- 1021508 broken-link vendor-advisory
- support.avaya.com third-party-advisory
- svn.apache.org vendor-advisory
- www.gossamer-threads.com third-party-advisory
- MDKSA-2007:083 third-party-advisory vendor-advisory
- SUSE-SR:2007:012 broken-link vendor-advisory
- SUSE-SR:2007:008 broken-link vendor-advisory
- RHSA-2007:0396 third-party-advisory vendor-advisory
- RHSA-2007:0486 third-party-advisory vendor-advisory
- RHSA-2008:0261 third-party-advisory vendor-advisory
- RHSA-2008:0627 third-party-advisory vendor-advisory
- 23192 third-party-advisory vdb-entry
- 1018259 third-party-advisory vdb-entry
- 2007-0023 broken-link vendor-advisory
- USN-488-1 third-party-advisory vendor-advisory
- ADV-2007-1150 third-party-advisory vdb-entry
- modperl-pathinfo-dos(33312) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:10987 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:8349 signature third-party-advisory vdb-entry
- Debian Security Tracker CVE-2007-1349 vendor-advisory
- bugs.debian.org issue-tracking