Vulnerability Description
The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Andy Armstrong | Cgi.Pm | <= 3.49 |
| Andy Armstrong | Cgi-Simple | <= 1.112 |
Related Weaknesses (CWE)
References
- http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.h
- http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.h
- http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.ht
- http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.ht
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
- http://openwall.com/lists/oss-security/2010/12/01/1Patch
- http://openwall.com/lists/oss-security/2010/12/01/2
- http://openwall.com/lists/oss-security/2010/12/01/3Patch
- http://osvdb.org/69588
- http://osvdb.org/69589
FAQ
What is CVE-2010-2761?
CVE-2010-2761 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which ...
How severe is CVE-2010-2761?
CVE-2010-2761 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-2761?
Check the references section above for vendor advisories and patch information. Affected products include: Andy Armstrong Cgi.Pm, Andy Armstrong Cgi-Simple.