Support / Security / Advisories / Corporate Server 4.0 / MDVSA-2010:237

Package name: perl-CGI
Date: 2010-11-16
Advisory ID: MDVSA-2010:237
Affected versions: 2009.0 x86_64 , MES5 i586 , 2010.0 x86_64 , 2010.1 i586 , 2010.0 i586 , 2009.0 i586 , CS4.0 i586 , CS4.0 x86_64 , MES5 x86_64 , 2010.1 x86_64

Problem description

A new version of the CGI Perl module has been released to CPAN,
which fixes several security bugs which directly affect Bugzilla
(these two security bugs where first discovered as affecting Bugzilla,
then identified as being bugs in CGI.pm itself).

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm
in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME
boundary string in multipart/x-mixed-replace content, which allows
remote attackers to inject arbitrary HTTP headers and conduct HTTP
response splitting attacks via crafted input that contains this value,
a different vulnerability than CVE-2010-3172 (CVE-2010-2761).

CRLF injection vulnerability in the header function in (1) CGI.pm
before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows
remote attackers to inject arbitrary HTTP headers and conduct HTTP
response splitting attacks via vectors related to non-whitespace
characters preceded by newline characters, a different vulnerability
than CVE-2010-2761 and CVE-2010-3172 (CVE-2010-4410).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been upgraded to perl-CGI 3.50 to solve
these security issues.

Updated packages

2009.0 x86_64

 2037517b54e8d66f0723def93e517a98  2009.0/x86_64/perl-CGI-3.50-0.1mdv2009.0.noarch.rpm
 6d973b61b591423cc5a6cefc45e79246  2009.0/x86_64/perl-CGI-Fast-3.50-0.1mdv2009.0.noarch.rpm 
 62127170b0a14878ce3abbe005cab32a  2009.0/SRPMS/perl-CGI-3.50-0.1mdv2009.0.src.rpm

MES5 i586

 a2a125c0033735e3ca343f2fae5fa963  mes5/i586/perl-CGI-3.50-0.1mdvmes5.1.noarch.rpm
 83befd3d04dbb1cbfe7f2cc80ac2ab68  mes5/i586/perl-CGI-Fast-3.50-0.1mdvmes5.1.noarch.rpm 
 68570870b628412f0c5597b5dca0dc7c  mes5/SRPMS/perl-CGI-3.50-0.1mdvmes5.1.src.rpm

2010.0 x86_64

 49ed79c77ef68d48764265f25e628720  2010.0/x86_64/perl-CGI-3.500.0-0.1mdv2010.0.noarch.rpm
 df6034c9f43698c09e2c39b7f74b97c7  2010.0/x86_64/perl-CGI-Fast-3.500.0-0.1mdv2010.0.noarch.rpm 
 cf30d84a555bb43eec281632224fdebc  2010.0/SRPMS/perl-CGI-3.500.0-0.1mdv2010.0.src.rpm

2010.1 i586

 aa106446efb83bb806133032ee27d8ed  2010.1/i586/perl-CGI-3.500.0-0.1mdv2010.1.noarch.rpm
 1cfde3769b9b04fc9c80eac20c8d52db  2010.1/i586/perl-CGI-Fast-3.500.0-0.1mdv2010.1.noarch.rpm 
 687a844f7fc927d1c00c963d4339b2fe  2010.1/SRPMS/perl-CGI-3.500.0-0.1mdv2010.1.src.rpm

2010.0 i586

 9ce05f7633402cb6a4034c6904b2b1c8  2010.0/i586/perl-CGI-3.500.0-0.1mdv2010.0.noarch.rpm
 89d297ceeceaec673712990953d69c55  2010.0/i586/perl-CGI-Fast-3.500.0-0.1mdv2010.0.noarch.rpm 
 cf30d84a555bb43eec281632224fdebc  2010.0/SRPMS/perl-CGI-3.500.0-0.1mdv2010.0.src.rpm

2009.0 i586

 54cece3ad5ca0d9a605acb06b4712dbe  2009.0/i586/perl-CGI-3.50-0.1mdv2009.0.noarch.rpm
 b1973045ea14cf9a8b1dc83ac8a4fde6  2009.0/i586/perl-CGI-Fast-3.50-0.1mdv2009.0.noarch.rpm 
 62127170b0a14878ce3abbe005cab32a  2009.0/SRPMS/perl-CGI-3.50-0.1mdv2009.0.src.rpm

CS4.0 i586

 56b0deb154ab35a724a8b7d3f6c95fac  corporate/4.0/i586/perl-CGI-3.50-0.1.20060mlcs4.noarch.rpm
 ff3f4ac61aa4586b956d328a923cc179  corporate/4.0/i586/perl-CGI-Fast-3.50-0.1.20060mlcs4.noarch.rpm 
 ba49f7da52a13223ac83910dd849f794  corporate/4.0/SRPMS/perl-CGI-3.50-0.1.20060mlcs4.src.rpm

CS4.0 x86_64

 50945ecb0af6e4a8c60a8440f75603ee  corporate/4.0/x86_64/perl-CGI-3.50-0.1.20060mlcs4.noarch.rpm
 0c778aebfef45e4387b43b83769e61a3  corporate/4.0/x86_64/perl-CGI-Fast-3.50-0.1.20060mlcs4.noarch.rpm 
 ba49f7da52a13223ac83910dd849f794  corporate/4.0/SRPMS/perl-CGI-3.50-0.1.20060mlcs4.src.rpm

MES5 x86_64

 b3529e11d2034fc58fa661824d89bda0  mes5/x86_64/perl-CGI-3.50-0.1mdvmes5.1.noarch.rpm
 31b335a4ff312e234cf74775d0025826  mes5/x86_64/perl-CGI-Fast-3.50-0.1mdvmes5.1.noarch.rpm 
 68570870b628412f0c5597b5dca0dc7c  mes5/SRPMS/perl-CGI-3.50-0.1mdvmes5.1.src.rpm

2010.1 x86_64

 b12af6b51121538c51243fd9dcd24262  2010.1/x86_64/perl-CGI-3.500.0-0.1mdv2010.1.noarch.rpm
 8638143729dea17fc546677d1e9ebae0  2010.1/x86_64/perl-CGI-Fast-3.500.0-0.1mdv2010.1.noarch.rpm 
 687a844f7fc927d1c00c963d4339b2fe  2010.1/SRPMS/perl-CGI-3.500.0-0.1mdv2010.1.src.rpm

MDVSA-2010:237