CVE-2011-2766
First published: Thu Sep 08 2011(Updated: )
It was found that the perl Fast CGI module did not properly clean up certain environment variables, related to a particular HTTP request, between subsequent incoming requests. Any environment variable set in the first pass through the code by processing the first request, that wasn't set in some subsequent request, has been added to the hash containing environment variables for that subsequent request. A remote attacker could use this flaw to bypass the authentication process and obtain access to resources, which would be otherwise protected by authentication. References: [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| FastCGI | >=0.70<=0.73 | |
| Debian Linux | =5.0 | |
| Debian Linux | =7.0 | |
| Debian Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2011/09/08/1
- http://www.securityfocus.com/bid/49549
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479
- https://rt.cpan.org/Public/Bug/Display.html?id=68380
- https://bugzilla.redhat.com/show_bug.cgi?id=736604
- http://www.openwall.com/lists/oss-security/2011/09/08/2
- http://www.debian.org/security/2011/dsa-2327
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:001
- https://hermes.opensuse.org/messages/13155253
- https://hermes.opensuse.org/messages/13154637
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69709
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=736608
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=736609
- http://proxy:8080
- http://www.myserver.nl/env.fcgi
- https://access.redhat.com/security/cve/CVE-2011-2766
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=736604#c6
Frequently Asked Questions
What is the severity of CVE-2011-2766?
CVE-2011-2766 is rated as a medium severity vulnerability due to improper handling of environment variables that could allow sensitive data exposure.
What are the affected versions for CVE-2011-2766?
CVE-2011-2766 affects Fast CGI versions between 0.70 and 0.73 and Debian versions 5.0, 6.0, and 7.0.
How do I fix CVE-2011-2766?
To fix CVE-2011-2766, upgrade the Fast CGI module to a version later than 0.73.
What type of vulnerability is CVE-2011-2766?
CVE-2011-2766 is categorized as an improper environment variable handling vulnerability.
Can CVE-2011-2766 lead to security breaches?
Yes, CVE-2011-2766 can lead to potential information disclosure and security breaches if not mitigated.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-2766
- agent/author
- agent/remedy
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/fast cgi project
- canonical/fastcgi
- version/fastcgi/0.70
- version/fastcgi/0.73
- vendor/debian
- canonical/debian linux
- version/debian linux/5.0
- version/debian linux/7.0
- version/debian linux/6.0