Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
0

CVE-2010-2761

Disclosure Date: December 06, 2010 •
CVE-2010-2761
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Vector:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
n/a
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • andy armstrong

Products

  • cgi-simple,
  • cgi-simple 0.078,
  • cgi-simple 0.079,
  • cgi-simple 0.080,
  • cgi-simple 0.081,
  • cgi-simple 0.082,
  • cgi-simple 0.83,
  • cgi-simple 1.0,
  • cgi-simple 1.1,
  • cgi-simple 1.1.1,
  • cgi-simple 1.1.2,
  • cgi-simple 1.103,
  • cgi-simple 1.104,
  • cgi-simple 1.105,
  • cgi-simple 1.106,
  • cgi-simple 1.107,
  • cgi-simple 1.108,
  • cgi-simple 1.109,
  • cgi-simple 1.110,
  • cgi-simple 1.111,
  • cgi.pm,
  • cgi.pm 1.4,
  • cgi.pm 1.42,
  • cgi.pm 1.43,
  • cgi.pm 1.44,
  • cgi.pm 1.45,
  • cgi.pm 1.50,
  • cgi.pm 1.51,
  • cgi.pm 1.52,
  • cgi.pm 1.53,
  • cgi.pm 1.54,
  • cgi.pm 1.55,
  • cgi.pm 1.56,
  • cgi.pm 1.57,
  • cgi.pm 2.0,
  • cgi.pm 2.01,
  • cgi.pm 2.13,
  • cgi.pm 2.14,
  • cgi.pm 2.15,
  • cgi.pm 2.16,
  • cgi.pm 2.17,
  • cgi.pm 2.18,
  • cgi.pm 2.19,
  • cgi.pm 2.20,
  • cgi.pm 2.21,
  • cgi.pm 2.22,
  • cgi.pm 2.23,
  • cgi.pm 2.24,
  • cgi.pm 2.25,
  • cgi.pm 2.26,
  • cgi.pm 2.27,
  • cgi.pm 2.28,
  • cgi.pm 2.29,
  • cgi.pm 2.30,
  • cgi.pm 2.31,
  • cgi.pm 2.32,
  • cgi.pm 2.33,
  • cgi.pm 2.34,
  • cgi.pm 2.35,
  • cgi.pm 2.36,
  • cgi.pm 2.37,
  • cgi.pm 2.38,
  • cgi.pm 2.39,
  • cgi.pm 2.40,
  • cgi.pm 2.41,
  • cgi.pm 2.42,
  • cgi.pm 2.43,
  • cgi.pm 2.44,
  • cgi.pm 2.45,
  • cgi.pm 2.46,
  • cgi.pm 2.47,
  • cgi.pm 2.48,
  • cgi.pm 2.49,
  • cgi.pm 2.50,
  • cgi.pm 2.51,
  • cgi.pm 2.52,
  • cgi.pm 2.53,
  • cgi.pm 2.54,
  • cgi.pm 2.55,
  • cgi.pm 2.56,
  • cgi.pm 2.57,
  • cgi.pm 2.58,
  • cgi.pm 2.59,
  • cgi.pm 2.60,
  • cgi.pm 2.61,
  • cgi.pm 2.62,
  • cgi.pm 2.63,
  • cgi.pm 2.64,
  • cgi.pm 2.65,
  • cgi.pm 2.66,
  • cgi.pm 2.67,
  • cgi.pm 2.68,
  • cgi.pm 2.69,
  • cgi.pm 2.70,
  • cgi.pm 2.71,
  • cgi.pm 2.72,
  • cgi.pm 2.73,
  • cgi.pm 2.74,
  • cgi.pm 2.75,
  • cgi.pm 2.751,
  • cgi.pm 2.752,
  • cgi.pm 2.76,
  • cgi.pm 2.77,
  • cgi.pm 2.78,
  • cgi.pm 2.79,
  • cgi.pm 2.80,
  • cgi.pm 2.81,
  • cgi.pm 2.82,
  • cgi.pm 2.83,
  • cgi.pm 2.84,
  • cgi.pm 2.85,
  • cgi.pm 2.86,
  • cgi.pm 2.87,
  • cgi.pm 2.88,
  • cgi.pm 2.89,
  • cgi.pm 2.90,
  • cgi.pm 2.91,
  • cgi.pm 2.92,
  • cgi.pm 2.93,
  • cgi.pm 2.94,
  • cgi.pm 2.95,
  • cgi.pm 2.96,
  • cgi.pm 2.97,
  • cgi.pm 2.98,
  • cgi.pm 2.99,
  • cgi.pm 3.00,
  • cgi.pm 3.01,
  • cgi.pm 3.02,
  • cgi.pm 3.03,
  • cgi.pm 3.04,
  • cgi.pm 3.05,
  • cgi.pm 3.06,
  • cgi.pm 3.07,
  • cgi.pm 3.08,
  • cgi.pm 3.09,
  • cgi.pm 3.10,
  • cgi.pm 3.11,
  • cgi.pm 3.12,
  • cgi.pm 3.13,
  • cgi.pm 3.14,
  • cgi.pm 3.15,
  • cgi.pm 3.16,
  • cgi.pm 3.17,
  • cgi.pm 3.18,
  • cgi.pm 3.19,
  • cgi.pm 3.20,
  • cgi.pm 3.21,
  • cgi.pm 3.22,
  • cgi.pm 3.23,
  • cgi.pm 3.24,
  • cgi.pm 3.25,
  • cgi.pm 3.26,
  • cgi.pm 3.27,
  • cgi.pm 3.28,
  • cgi.pm 3.29,
  • cgi.pm 3.30,
  • cgi.pm 3.31,
  • cgi.pm 3.32,
  • cgi.pm 3.33,
  • cgi.pm 3.34,
  • cgi.pm 3.35,
  • cgi.pm 3.36,
  • cgi.pm 3.37,
  • cgi.pm 3.38,
  • cgi.pm 3.39,
  • cgi.pm 3.40,
  • cgi.pm 3.41,
  • cgi.pm 3.42,
  • cgi.pm 3.43,
  • cgi.pm 3.44,
  • cgi.pm 3.45,
  • cgi.pm 3.46,
  • cgi.pm 3.47,
  • cgi.pm 3.48

References

Canonical
CVE-2010-2761 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2761)
Advisory
http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm
http://www.redhat.com/support/errata/RHSA-2011-1797.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
FEDORA-2011-0653 (http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html)
SECUNIA-43068 (http://secunia.com/advisories/43068)
[oss-security] 20101201 Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) (http://openwall.com/lists/oss-security/2010/12/01/2)
OSVDB-69588 (http://osvdb.org/69588)
SECUNIA-43165 (http://secunia.com/advisories/43165)
[oss-security] 20101201 Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) (http://openwall.com/lists/oss-security/2010/12/01/3)
ADV-2011-0212 (http://www.vupen.com/english/advisories/2011/0212)
https://bugzilla.mozilla.org/show_bug.cgi?id=591165
https://github.com/AndyA/CGI--Simple/commit/e4942b871a26c1317a175a91ebb7262eea59b380
http://www.bugzilla.org/security/3.2.9
FEDORA-2011-0741 (http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html)
http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
ADV-2011-0271 (http://www.vupen.com/english/advisories/2011/0271)
SECUNIA-43033 (http://secunia.com/advisories/43033)
ADV-2011-0207 (http://www.vupen.com/english/advisories/2011/0207)
SECUNIA-42877 (http://secunia.com/advisories/42877)
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1
ADV-2011-0249 (http://www.vupen.com/english/advisories/2011/0249)
FEDORA-2011-0755 (http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html)
http://www.mandriva.com/security/advisories?name=MDVSA-2010:250
http://www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:237
OSVDB-69589 (http://osvdb.org/69589)
ADV-2011-0076 (http://www.vupen.com/english/advisories/2011/0076)
[oss-security] 20101201 CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) (http://openwall.com/lists/oss-security/2010/12/01/1)
http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes
FEDORA-2011-0631 (http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
SECUNIA-43147 (http://secunia.com/advisories/43147)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
Miscellaneous
https://bugzilla.mozilla.org/show_bug.cgi?id=600464

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis