CVE-2011-2766: High severity fastcgi vulnerability
It was found that the perl Fast CGI module did not properly clean up certain environment variables, related to a particular HTTP request, between subsequent incoming requests. Any environment variable set in the first pass through the code by processing the first request, that wasn't set in some subsequent request, has been added to the hash containing environment variables for that subsequent request. A remote attacker could use this flaw to bypass the authentication process and obtain access to resources, which would be otherwise protected by authentication.
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479
Other sources
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2766?
CVE-2011-2766 is rated as a medium severity vulnerability due to improper handling of environment variables that could allow sensitive data exposure.
What are the affected versions for CVE-2011-2766?
CVE-2011-2766 affects Fast CGI versions between 0.70 and 0.73 and Debian versions 5.0, 6.0, and 7.0.
How do I fix CVE-2011-2766?
To fix CVE-2011-2766, upgrade the Fast CGI module to a version later than 0.73.
What type of vulnerability is CVE-2011-2766?
CVE-2011-2766 is categorized as an improper environment variable handling vulnerability.
Can CVE-2011-2766 lead to security breaches?
Yes, CVE-2011-2766 can lead to potential information disclosure and security breaches if not mitigated.