CVE-2010-2761

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CGI.pm 是用途广泛的Perl模块，为编程公共网关接口(CGI)应用，提供一致 API 为接受用户输入和生产HTML或XHTML产品。 (1)CGI.pm 3.50之前版本以及(2)CGI::Simple中的Simple.pm 1.112及之前版本中的multipart_init函数使用了multipart/x-mixed-replace内容中的MIME边界字符串的硬编码值。远程攻击者可以借助包含该值的特制输入，注入任意HTTP头以及进行HTTP响应分裂攻击。

CVE-2010-2761 affects n/a n/a. No confirmed in-the-wild exploitation; assess based on exposure. CGI.pm 是用途广泛的Perl模块，为编程公共网关接口(CGI)应用，提供一致 API 为接受用户输入和生产HTML或XHTML产品。 (1)CGI.pm 3.50之前版本以及(2)CGI::Simple中的Simple.pm 1.112及之前版本中的multipart_init函数使用了multipart/x-mixed-replace内容中的MIME CVE-2010-2761 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2010-2761

I. Basic Information for CVE-2010-2761

Affected Products

II. Public POCs for CVE-2010-2761

III. Intelligence Information for CVE-2010-2761

Patches & Fixes for CVE-2010-2761 (1)

• https://github.com/AndyA/CGI--Simple/commit/e4942b871a26c1317a175a91ebb7262eea59b380 x_refsource_CONFIRM

Vendor Advisories for CVE-2010-2761 (18)

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 x_refsource_CONFIRM
• https://bugzilla.mozilla.org/show_bug.cgi?id=600464 x_refsource_MISC
• https://bugzilla.mozilla.org/show_bug.cgi?id=591165 x_refsource_CONFIRM
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 x_refsource_CONFIRM
• http://secunia.com/advisories/43165 third-party-advisory x_refsource_SECUNIA
• http://osvdb.org/69588 vdb-entry x_refsource_OSVDB
• http://secunia.com/advisories/43147 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42877 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/43068 third-party-advisory x_refsource_SECUNIA
• http://osvdb.org/69589 vdb-entry x_refsource_OSVDB
• http://secunia.com/advisories/43033 third-party-advisory x_refsource_SECUNIA
• http://www.vupen.com/english/advisories/2011/0271 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0249 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0076 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0212 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0207 vdb-entry x_refsource_VUPEN
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:237 vendor-advisory x_refsource_MANDRIVA
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:250 vendor-advisory x_refsource_MANDRIVA

Mailing List Discussions for CVE-2010-2761 (9)

• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html vendor-advisory x_refsource_SUSE
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html vendor-advisory x_refsource_FEDORA
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html vendor-advisory x_refsource_SUSE
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html vendor-advisory x_refsource_FEDORA
• http://openwall.com/lists/oss-security/2010/12/01/1 mailing-list x_refsource_MLIST
• http://openwall.com/lists/oss-security/2010/12/01/2 mailing-list x_refsource_MLIST
• http://openwall.com/lists/oss-security/2010/12/01/3 mailing-list x_refsource_MLIST

Other References for CVE-2010-2761 (6)

• http://www.bugzilla.org/security/3.2.9/ x_refsource_CONFIRM
• http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes x_refsource_CONFIRM
• http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm x_refsource_CONFIRM
• http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1 x_refsource_CONFIRM
• http://www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html x_refsource_CONFIRM
• http://www.redhat.com/support/errata/RHSA-2011-1797.html vendor-advisory x_refsource_REDHAT

• https://www.cve.org/CVERecord?id=CVE-2010-2761

Same Patch Batch · n/a · 2010-12-06 · 17 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2010-2761