BugTraq
[ MDVSA-2010:252 ] perl-CGI-Simple Dec 14 2010 03:57PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:252
http://www.mandriva.com/security/
_______________________________________________________________________

Package : perl-CGI-Simple
Date : December 14, 2010
Affected: Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in perl-CGI-Simple:

CRLF injection vulnerability in the header function in (1) CGI.pm
before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows
remote attackers to inject arbitrary HTTP headers and conduct HTTP
response splitting attacks via vectors related to non-whitespace
characters preceded by newline characters, a different vulnerability
than CVE-2010-2761 and CVE-2010-3172 (CVE-2010-4410).

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4410
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
575a970c9dc85982b88b3610f881aeea corporate/4.0/i586/perl-CGI-Simple-0.077-1.2.20060mlcs4.noarch.rpm
4cf16af44ac7aeaee3e950f8029ae1ef corporate/4.0/SRPMS/perl-CGI-Simple-0.077-1.2.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
28c8101be550456f2406b9d1ccb81284 corporate/4.0/x86_64/perl-CGI-Simple-0.077-1.2.20060mlcs4.noarch.rpm
4cf16af44ac7aeaee3e950f8029ae1ef corporate/4.0/SRPMS/perl-CGI-Simple-0.077-1.2.20060mlcs4.src.rpm

Mandriva Enterprise Server 5:
9f8ac88c6490d5e3c37abb221b88deb0 mes5/i586/perl-CGI-Simple-1.1-4.2mdvmes5.1.noarch.rpm
d64f4d1322a327ac2f5a9bdde280525a mes5/SRPMS/perl-CGI-Simple-1.1-4.2mdvmes5.1.src.rpm

Mandriva Enterprise Server 5/X86_64:
1c1dcd1d837926671b4a79a9e9147c2c mes5/x86_64/perl-CGI-Simple-1.1-4.2mdvmes5.1.noarch.rpm
d64f4d1322a327ac2f5a9bdde280525a mes5/SRPMS/perl-CGI-Simple-1.1-4.2mdvmes5.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFNB2exmqjQ0CJFipgRArWUAKClSubb6KQ00eoa8DAWb5y69HmE/gCgmK2M
ZRCQ7M0z7QNT/LpwCauGua0=
=jCE1
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus