ID CVE-2007-1349
Summary PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
References
Vulnerable Configurations
  • Apache Software Foundation Apache_test 1.29
    cpe:2.3:a:apache:apache_test:1.29
  • Apache Software Foundation Apache HTTP Server
    cpe:2.3:a:apache:http_server
  • Apache Software Foundation mod_perl 2.0.0
    cpe:2.3:a:apache:mod_perl:2.0.0
  • Apache Software Foundation mod_perl 2.0.1
    cpe:2.3:a:apache:mod_perl:2.0.1
  • Apache Software Foundation mod_perl 2.0.2
    cpe:2.3:a:apache:mod_perl:2.0.2
  • Apache Software Foundation mod_perl 2.0.3
    cpe:2.3:a:apache:mod_perl:2.0.3
CVSS
Base: 4.3 (as of 30-03-2007 - 09:33)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0395.NASL
    description Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. An issue was found in the 'namespace_from_uri' method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service (CVE-2007-1349). Users of mod_perl should update to these erratum packages which contain a backported fix to correct this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25526
    published 2007-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25526
    title CentOS 3 / 4 / 5 : mod_perl (CESA-2007:0395)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200705-04.NASL
    description The remote host is affected by the vulnerability described in GLSA-200705-04 (Apache mod_perl: Denial of Service) Alex Solvey discovered that the 'path_info' variable used in file RegistryCooker.pm (mod_perl 2.x) or file PerlRun.pm (mod_perl 1.x), is not properly escaped before being processed. Impact : A remote attacker could send a specially crafted URL to the vulnerable server, possibly resulting in a massive resource consumption. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 25154
    published 2007-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25154
    title GLSA-200705-04 : Apache mod_perl: Denial of Service
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0263.NASL
    description Red Hat Network Proxy Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Proxy Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. The Red Hat Network Proxy Server 5.0.2 release corrects several security vulnerabilities in several shipped components. In a typical operating environment, these components are not exposed to users of Proxy Server in a vulnerable manner. These security updates will reduce risk in unique Proxy Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting or denial-of-service attack. (CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Users of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2, which resolves these issues.
    last seen 2019-02-21
    modified 2017-01-10
    plugin id 63853
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63853
    title RHEL 4 : Proxy Server (RHSA-2008:0263)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0395.NASL
    description Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. An issue was found in the 'namespace_from_uri' method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service (CVE-2007-1349). Users of mod_perl should update to these erratum packages which contain a backported fix to correct this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25519
    published 2007-06-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25519
    title RHEL 3 / 4 / 5 : mod_perl (RHSA-2007:0395)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_122911-32.NASL
    description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/11/13
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107381
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107381
    title Solaris 10 (sparc) : 122911-32
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0630.NASL
    description Red Hat Network Satellite Server version 5.1.1 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. During an internal security audit, it was discovered that Red Hat Network Satellite Server shipped with an XML-RPC script, manzier.pxt, which had a single hard-coded authentication key. A remote attacker who is able to connect to the Satellite Server XML-RPC service could use this flaw to obtain limited information about Satellite Server users, such as login names, associated email addresses, internal user IDs, and partial information about entitlements. (CVE-2008-2369) This release also corrects several security vulnerabilities in various components shipped as part of Red Hat Network Satellite Server 5.1. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306) A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898) Multiple flaws were fixed in the Apache Tomcat package. (CVE-2005-4838, CVE-2006-0254, CVE-2007-1355, CVE-2007-1358, CVE-2007-2449, CVE-2007-5461, CVE-2008-0128) Users of Red Hat Network Satellite Server 5.1 are advised to upgrade to 5.1.1, which resolves these issues.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 43840
    published 2010-01-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43840
    title RHEL 4 : Satellite Server (RHSA-2008:0630)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_122911.NASL
    description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16 This plugin has been deprecated and either replaced with individual 122911 patch-revision plugins, or deemed non-security related.
    last seen 2019-02-21
    modified 2018-07-30
    plugin id 22060
    published 2006-07-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22060
    title Solaris 10 (sparc) : 122911-37 (deprecated)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_122911-33.NASL
    description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/15/14
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107382
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107382
    title Solaris 10 (sparc) : 122911-33
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0627.NASL
    description Red Hat Network Proxy Server version 5.1.1 is now available. This update includes a fix for a security issue in a Red Hat Network Proxy Server component. This update has been rated as having low security impact by the Red Hat Security Response Team. The Red Hat Network Proxy Server 5.1.1 release corrects a security vulnerability in a shipped component. In a typical operating environment, this component is not exposed to users of Proxy Server in a vulnerable manner. This security update will reduce risk in unique Proxy Server environments. A flaw was found in the mod_perl 'ModPerl::RegistryCooker' class. If a server implemented a mod_perl registry module using the 'namespace_from_uri' method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service. (CVE-2007-1349) Users of Red Hat Network Proxy Server 5.1 are advised to upgrade to 5.1.1, which resolves this issue.
    last seen 2019-02-21
    modified 2014-05-02
    plugin id 63859
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63859
    title RHEL 4 : Proxy Server (RHSA-2008:0627)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_EF2FFB03F2B011DBAD250010B5A0A860.NASL
    description Mandriva reports : PerlRun.pm in Apache mod_perl 1.29 and earlier, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25103
    published 2007-04-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25103
    title FreeBSD : mod_perl -- remote DoS in PATH_INFO parsing (ef2ffb03-f2b0-11db-ad25-0010b5a0a860)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-0316.NASL
    description This update fixes a security issue in mod_perl. An issue was found in the 'namespace_from_uri' method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service. (CVE-2007-1349) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-21
    plugin id 27658
    published 2007-11-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27658
    title Fedora 7 : mod_perl-2.0.3-9.1.fc7 (2007-0316)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_122912-34.NASL
    description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/13/15
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107885
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107885
    title Solaris 10 (x86) : 122912-34
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_122911-37.NASL
    description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107386
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107386
    title Solaris 10 (sparc) : 122911-37
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_122912-37.NASL
    description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107888
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107888
    title Solaris 10 (x86) : 122912-37
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_122912-36.NASL
    description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/02/16
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107887
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107887
    title Solaris 10 (x86) : 122912-36
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_122911-34.NASL
    description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/13/15
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107383
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107383
    title Solaris 10 (sparc) : 122911-34
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0486.NASL
    description Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache HTTP server can directly execute Perl code. The Apache::PerlRun module was found to not properly escape PATH_INFO before being used in a regular expression. If a server is configured to use Apache::PerlRun, an attacker could request a carefully crafted URI causing resource consumption, which could lead to a denial of service (CVE-2007-1349). Users of mod_perl should update to these erratum packages which contain a backported fix to correct this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25539
    published 2007-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25539
    title RHEL 2.1 : mod_perl (RHSA-2007:0486)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_122912-33.NASL
    description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/15/14
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107884
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107884
    title Solaris 10 (x86) : 122912-33
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_122912-35.NASL
    description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Nov/12/15
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107886
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107886
    title Solaris 10 (x86) : 122912-35
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_122912-32.NASL
    description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/11/13
    last seen 2018-10-31
    modified 2018-10-29
    plugin id 107883
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107883
    title Solaris 10 (x86) : 122912-32
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_122911-36.NASL
    description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/02/16
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107385
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107385
    title Solaris 10 (sparc) : 122911-36
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_122911-35.NASL
    description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Nov/12/15
    last seen 2018-10-27
    modified 2018-10-26
    plugin id 107384
    published 2018-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=107384
    title Solaris 10 (sparc) : 122911-35
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS10_X86_122912.NASL
    description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16 This plugin has been deprecated and either replaced with individual 122912 patch-revision plugins, or deemed non-security related.
    last seen 2019-02-21
    modified 2018-07-30
    plugin id 22063
    published 2006-07-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=22063
    title Solaris 10 (x86) : 122912-37 (deprecated)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0523.NASL
    description Red Hat Network Proxy Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Proxy Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. The Red Hat Network Proxy Server 4.2.3 release corrects several security vulnerabilities in several shipped components. In a typical operating environment, these components are not exposed to users of Proxy Server in a vulnerable manner. These security updates will reduce risk in unique Proxy Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting or denial-of-service attack. (CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752, CVE-2006-3918, CVE-2005-3352) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.
    last seen 2019-02-21
    modified 2017-01-10
    plugin id 63857
    published 2013-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63857
    title RHEL 3 / 4 : Proxy Server (RHSA-2008:0523)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-083.NASL
    description PerlRun.pm in Apache mod_perl 1.30 and earlier, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. Updated packages have been patched to correct this issue.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 25034
    published 2007-04-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25034
    title Mandrake Linux Security Advisory : apache-mod_perl (MDKSA-2007:083)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-488-1.NASL
    description Alex Solovey discovered that mod_perl did not correctly validate certain regular expression matches. A remote attacker could send a specially crafted request to a web application using mod_perl, causing the web server to monopolize CPU resources. This could lead to a remote denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 28089
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28089
    title Ubuntu 6.06 LTS / 6.10 / 7.04 : libapache2-mod-perl2 vulnerability (USN-488-1)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS8_X86_116974.NASL
    description SunOS 5.8_x86: Apache Patch. Date this patch was last updated by Sun : Apr/23/08
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 15483
    published 2004-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15483
    title Solaris 8 (x86) : 116974-07
  • NASL family SuSE Local Security Checks
    NASL id SUSE9_11496.NASL
    description Insufficient quoting of special characters in the PATH_INFO variable could lead to excessive ressource consumption and a denial of service via a specially crafted URL. (CVE-2007-1349)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 41127
    published 2009-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=41127
    title SuSE9 Security Update : mod_perl (YOU Patch Number 11496)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS9_113146.NASL
    description SunOS 5.9: Apache Security Patch. Date this patch was last updated by Sun : Mar/05/10
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 13530
    published 2004-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=13530
    title Solaris 9 (sparc) : 113146-13
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0261.NASL
    description Red Hat Network Satellite Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components. This update has been rated as having moderate security impact by the Red Hat Security Response Team. During an internal security review, a cross-site scripting flaw was found that affected the Red Hat Network channel search feature. (CVE-2007-5961) This release also corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306) Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789) Two arbitrary code execution flaws were fixed in the OpenMotif package. (CVE-2005-3964, CVE-2005-0605) A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898) Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510) Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to 5.0.2, which resolves these issues.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 43835
    published 2010-01-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43835
    title RHEL 4 : Satellite Server (RHSA-2008:0261)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS9_X86_114145.NASL
    description SunOS 5.9_x86: Apache Security Patch. Date this patch was last updated by Sun : Mar/05/10
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 13593
    published 2004-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=13593
    title Solaris 9 (x86) : 114145-12
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2008-0524.NASL
    description Red Hat Network Satellite Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server 4.2. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306) Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789) Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687, CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605) A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898) Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510) Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 43837
    published 2010-01-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43837
    title RHEL 3 / 4 : Satellite Server (RHSA-2008:0524)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070614_MOD_PERL_ON_SL5_X.NASL
    description An issue was found in the 'namespace_from_uri' method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service (CVE-2007-1349).
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60211
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60211
    title Scientific Linux Security Update : mod_perl on SL5.x, SL4.x, SL3.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0395.NASL
    description From Red Hat Security Advisory 2007:0395 : Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. An issue was found in the 'namespace_from_uri' method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service (CVE-2007-1349). Users of mod_perl should update to these erratum packages which contain a backported fix to correct this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67508
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67508
    title Oracle Linux 3 / 4 / 5 : mod_perl (ELSA-2007-0395)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS8_116973.NASL
    description SunOS 5.8: Apache Patch. Date this patch was last updated by Sun : Apr/24/08
    last seen 2018-09-01
    modified 2016-12-09
    plugin id 15482
    published 2004-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15482
    title Solaris 8 (sparc) : 116973-07
oval via4
  • accepted 2013-04-29T04:10:29.086-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    • comment The operating system installed on the system is Red Hat Enterprise Linux 5
      oval oval:org.mitre.oval:def:11414
    • comment The operating system installed on the system is CentOS Linux 5.x
      oval oval:org.mitre.oval:def:15802
    • comment Oracle Linux 5.x
      oval oval:org.mitre.oval:def:15459
    description PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
    family unix
    id oval:org.mitre.oval:def:10987
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
    version 24
  • accepted 2010-06-07T04:01:05.430-04:00
    class vulnerability
    contributors
    name Pai Peng
    organization Hewlett-Packard
    definition_extensions
    • comment Solaris 10 (SPARC) is installed
      oval oval:org.mitre.oval:def:1440
    • comment Solaris 10 (x86) is installed
      oval oval:org.mitre.oval:def:1926
    description PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
    family unix
    id oval:org.mitre.oval:def:8349
    status accepted
    submitted 2010-03-16T15:16:58.000-04:00
    title Security Vulnerabilities in the Apache 2 "mod_perl2" Module Components "PerlRun.pm" May Lead to Denial of Service (DoS) or Unauthorized Access to Data
    version 32
redhat via4
advisories
  • bugzilla
    id 240423
    title CVE-2007-1349 mod_perl PerlRun denial of service
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 3 is installed
        oval oval:com.redhat.rhba:tst:20070026001
      • OR
        • AND
          • comment mod_perl is earlier than 0:1.99_09-12.ent
            oval oval:com.redhat.rhsa:tst:20070395002
          • comment mod_perl is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070395003
        • AND
          • comment mod_perl-devel is earlier than 0:1.99_09-12.ent
            oval oval:com.redhat.rhsa:tst:20070395004
          • comment mod_perl-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070395005
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304001
      • OR
        • AND
          • comment mod_perl is earlier than 0:1.99_16-4.5
            oval oval:com.redhat.rhsa:tst:20070395007
          • comment mod_perl is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070395003
        • AND
          • comment mod_perl-devel is earlier than 0:1.99_16-4.5
            oval oval:com.redhat.rhsa:tst:20070395008
          • comment mod_perl-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070395005
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331001
      • OR
        • AND
          • comment mod_perl is earlier than 0:2.0.2-6.3.el5
            oval oval:com.redhat.rhsa:tst:20070395010
          • comment mod_perl is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070395011
        • AND
          • comment mod_perl-devel is earlier than 0:2.0.2-6.3.el5
            oval oval:com.redhat.rhsa:tst:20070395012
          • comment mod_perl-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070395013
    rhsa
    id RHSA-2007:0395
    released 2007-06-14
    severity Low
    title RHSA-2007:0395: mod_perl security update (Low)
  • rhsa
    id RHSA-2007:0396
  • rhsa
    id RHSA-2007:0486
  • rhsa
    id RHSA-2008:0261
  • rhsa
    id RHSA-2008:0627
  • rhsa
    id RHSA-2008:0630
rpms
  • mod_perl-0:1.99_09-12.ent
  • mod_perl-devel-0:1.99_09-12.ent
  • mod_perl-0:1.99_16-4.5
  • mod_perl-devel-0:1.99_16-4.5
  • mod_perl-0:2.0.2-6.3.el5
  • mod_perl-devel-0:2.0.2-6.3.el5
refmap via4
bid 23192
confirm
gentoo GLSA-200705-04
mandriva MDKSA-2007:083
misc http://www.gossamer-threads.com/lists/modperl/modperl/92739
sectrack 1018259
secunia
  • 24678
  • 24839
  • 25072
  • 25110
  • 25432
  • 25655
  • 25730
  • 25894
  • 26084
  • 26231
  • 26290
  • 31490
  • 31493
  • 33720
  • 33723
sgi 20070602-01-P
sunalert
  • 1021508
  • 248386
suse
  • SUSE-SR:2007:008
  • SUSE-SR:2007:012
trustix 2007-0023
ubuntu USN-488-1
vupen ADV-2007-1150
xf modperl-pathinfo-dos(33312)
Last major update 05-11-2012 - 22:34
Published 29-03-2007 - 20:19
Last modified 10-10-2017 - 21:31
Back to Top