CVE-2011-2767: Code Injection
A flaw was found in modperl 2.0 through 2.0.10 which allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644169
Other sources
modperl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2767?
CVE-2011-2767 is classified as a critical vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2011-2767?
To mitigate CVE-2011-2767, upgrade to mod_perl version 2.0.11-4 or later.
What versions of mod_perl are affected by CVE-2011-2767?
CVE-2011-2767 affects mod_perl versions 2.0 through 2.0.10.
Can CVE-2011-2767 be exploited by unauthorized users?
Yes, unauthorized users can exploit CVE-2011-2767 by placing malicious Perl code in .htaccess files.
Is there a workaround for CVE-2011-2767 until I can update?
Disabling the use of .htaccess files or restricting their access can serve as a temporary workaround for CVE-2011-2767.