PT-2018-2725 · Apache+5 · Apache Http Server+6
Jan Ingvoldstad
·
Publicado
2018-08-26
·
Atualizado
2024-06-15
·
CVE-2011-2767
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
mod perl versions 2.0 through 2.0.10
Description
The issue allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file. This is possible because there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes. The vulnerability is related to code injection in the .htaccess file, which can be exploited by a remote attacker to execute arbitrary Perl code under the context of the user account running Apache HTTP Server processes.
Recommendations
For mod perl versions 2.0 through 2.0.10, consider disabling the execution of Perl code in .htaccess files until a patch is available. Restrict access to the .htaccess file to minimize the risk of exploitation. Avoid using Perl code in .htaccess files for HTTP request processing until the issue is resolved.
Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Apache Http Server
Centos
Red Hat
Suse
Ubuntu
Mod Perl