CVE-2011-2766
First published: Thu Sep 08 2011(Updated: )
It was found that the perl Fast CGI module did not properly clean up certain environment variables, related to a particular HTTP request, between subsequent incoming requests. Any environment variable set in the first pass through the code by processing the first request, that wasn't set in some subsequent request, has been added to the hash containing environment variables for that subsequent request. A remote attacker could use this flaw to bypass the authentication process and obtain access to resources, which would be otherwise protected by authentication. References: [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fast Cgi Project Fast Cgi | >=0.70<=0.73 | |
| Debian Debian Linux | =5.0 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2011/09/08/1
- http://www.securityfocus.com/bid/49549
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479
- https://rt.cpan.org/Public/Bug/Display.html?id=68380
- https://bugzilla.redhat.com/show_bug.cgi?id=736604
- http://www.openwall.com/lists/oss-security/2011/09/08/2
- http://www.debian.org/security/2011/dsa-2327
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:001
- https://hermes.opensuse.org/messages/13155253
- https://hermes.opensuse.org/messages/13154637
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69709
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=736608
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=736609
- http://proxy:8080
- http://www.myserver.nl/env.fcgi
- https://access.redhat.com/security/cve/CVE-2011-2766
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=736604#c6
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-2766
- agent/author
- agent/remedy
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/description
- agent/event
- agent/trending
- vendor/fast cgi project
- canonical/fast cgi project fast cgi
- version/fast cgi project fast cgi/0.70
- version/fast cgi project fast cgi/0.73
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/5.0
- version/debian debian linux/7.0
- version/debian debian linux/6.0