CVE-2011-2766 The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers t...
HighCVSS 7.5
EPSS 7.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libfcgi-perl(Debian:12) | < 0.73-2 | 0.73-2 |
| debian/libfcgi-perl(Debian:13) | < 0.73-2 | 0.73-2 |
| debian/libfcgi-perl(Debian:14) | < 0.73-2 | 0.73-2 |
| fast cgi project fast cgi | >= 0.70, <= 0.73 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2011-2766 vendor-advisory
- bugs.debian.org exploit issue-tracking mailing-list third-party-advisory
- DSA-2327 third-party-advisory vendor-advisory
- MDVSA-2012:001 third-party-advisory vendor-advisory
- [oss-security] 20110908 CVE Request -- libfcgi-perl / perl-FCGI: Certain environment variables shared between first and subsequent HTTP requests mailing-list third-party-advisory
- [oss-security] 20110908 Re: CVE Request -- libfcgi-perl / perl-FCGI: Certain environment variables shared between first and subsequent HTTP requests mailing-list third-party-advisory
- 49549 third-party-advisory vdb-entry
- bugzilla.redhat.com exploit issue-tracking third-party-advisory
- perlfast-cgi-security-bypass(69709) third-party-advisory vdb-entry
- openSUSE-SU-2012:0004 broken-link vendor-advisory
- openSUSE-SU-2012:0036 broken-link vendor-advisory
- rt.cpan.org exploit patch third-party-advisory
- bugs.debian.org issue-tracking