Vulnerability Description
CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Andy Armstrong | Cgi.Pm | <= 3.49 |
| Andy Armstrong | Cgi-Simple | <= 1.112 |
Related Weaknesses (CWE)
References
- http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.ht
- http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.ht
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
- http://openwall.com/lists/oss-security/2010/12/01/1Patch
- http://openwall.com/lists/oss-security/2010/12/01/2Patch
- http://openwall.com/lists/oss-security/2010/12/01/3Patch
- http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f5Patch
- http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467Patch
- http://secunia.com/advisories/43068
- http://secunia.com/advisories/43147
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:237
FAQ
What is CVE-2010-4410?
CVE-2010-4410 is a vulnerability with a CVSS score of 4.3 (MEDIUM). CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HT...
How severe is CVE-2010-4410?
CVE-2010-4410 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-4410?
Check the references section above for vendor advisories and patch information. Affected products include: Andy Armstrong Cgi.Pm, Andy Armstrong Cgi-Simple.