MESSAGE
| DATE | 2019-01-15 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [Hangout - NYLXS] Modperl security alert
|
CVE-2011-2767 Detail
Current Description
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl
code by placing it in a user-owned .htaccess file, because (contrary to
the documentation) there is no configuration option that permits Perl
code for the administrator's control of HTTP request processing without
also permitting unprivileged users to run Perl code in the context of
the user account that runs Apache HTTP Server processes.
Source: MITRE
Description Last Modified: 08/26/2018
View Analysis Description
Impact
CVSS v3.0 Severity and Metrics:
Base Score: 9.8 CRITICAL
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (V3 legend)
Impact Score: 5.9
Exploitability Score: 3.9
Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High
CVSS v2.0 Severity and Metrics:
Base Score: 10.0 HIGH
Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) (V2 legend)
Impact Subscore: 10.0
Exploitability Subscore: 10.0
Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (AU): None
Confidentiality (C): Complete
Integrity (I): Complete
Availability (A): Complete
Additional Information:
Allows unauthorized disclosure of information
Allows unauthorized modification
Allows disruption of service
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have
provided these links to other web sites because they may have
information that would be of interest to you. No inferences should be
drawn on account of other sites being referenced, or not, from this
page. There may be other web sites that are more appropriate for your
purpose. NIST does not necessarily endorse the views expressed, or
concur with the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on these sites.
Please address comments about this page to nvd-at-nist.gov.
Hyperlink Resource
http://www.securityfocus.com/bid/105195 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:2737 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2825 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2826 Third Party Advisory
https://bugs.debian.org/644169 Issue Tracking Mailing List Third Party
Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00018.html
Mailing List Third Party Advisory
https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E
Mailing List Third Party Advisory
https://usn.ubuntu.com/3825-1/ Third Party Advisory
https://usn.ubuntu.com/3825-2/ Third Party Advisory
Technical Details
Vulnerability Type (View All)
Code Injection (CWE-94)
Vulnerable software and versions Switch to CPE 2.2
Configuration 1
OR
cpe:2.3:a:apache:mod_perl:*:*:*:*:*:*:*:* versions from (including)
2.0.0 up to (including) 2.0.10
Configuration 2
OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Configuration 3
OR
cpe:2.3:o:redhat:enterprise_linux:6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Configuration 4
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
--
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013
_______________________________________________
Hangout mailing list
Hangout-at-nylxs.com
http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|
