Vulnerability Description
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Mod Perl | >= 2.0.0, <= 2.0.10 |
| Debian | Debian Linux | 8.0 |
| Redhat | Enterprise Linux | 6.0 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Canonical | Ubuntu Linux | 12.04 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
- http://www.securityfocus.com/bid/105195Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:2737Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2825Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2826Third Party Advisory
- https://bugs.debian.org/644169Issue TrackingMailing ListThird Party Advisory
- https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7
- https://lists.debian.org/debian-lts-announce/2018/09/msg00018.htmlMailing ListThird Party Advisory
- https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C201110Mailing ListThird Party Advisory
- https://usn.ubuntu.com/3825-1/Third Party Advisory
- https://usn.ubuntu.com/3825-2/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
- http://www.securityfocus.com/bid/105195Third Party AdvisoryVDB Entry
FAQ
What is CVE-2011-2767?
CVE-2011-2767 is a vulnerability with a CVSS score of 9.8 (CRITICAL). mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that ...
How severe is CVE-2011-2767?
CVE-2011-2767 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2011-2767?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Mod Perl, Debian Debian Linux, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server.