Lucene search

[email protected]NVD:CVE-2010-4410

HistoryDec 06, 2010 - 8:13 p.m.

CVE-2010-4410

2010-12-0620:13:00

CWE-94

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

9 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.8%

JSON

CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.

Affected configurations

NVD

Node

andy_armstrongcgi.pmRange≤3.49

andy_armstrongcgi.pmMatch1.4

andy_armstrongcgi.pmMatch1.42

andy_armstrongcgi.pmMatch1.43

andy_armstrongcgi.pmMatch1.44

andy_armstrongcgi.pmMatch1.45

andy_armstrongcgi.pmMatch1.50

andy_armstrongcgi.pmMatch1.51

andy_armstrongcgi.pmMatch1.52

andy_armstrongcgi.pmMatch1.53

andy_armstrongcgi.pmMatch1.54

andy_armstrongcgi.pmMatch1.55

andy_armstrongcgi.pmMatch1.56

andy_armstrongcgi.pmMatch1.57

andy_armstrongcgi.pmMatch2.0

andy_armstrongcgi.pmMatch2.01

andy_armstrongcgi.pmMatch2.13

andy_armstrongcgi.pmMatch2.14

andy_armstrongcgi.pmMatch2.15

andy_armstrongcgi.pmMatch2.16

andy_armstrongcgi.pmMatch2.17

andy_armstrongcgi.pmMatch2.18

andy_armstrongcgi.pmMatch2.19

andy_armstrongcgi.pmMatch2.20

andy_armstrongcgi.pmMatch2.21

andy_armstrongcgi.pmMatch2.22

andy_armstrongcgi.pmMatch2.23

andy_armstrongcgi.pmMatch2.24

andy_armstrongcgi.pmMatch2.25

andy_armstrongcgi.pmMatch2.26

andy_armstrongcgi.pmMatch2.27

andy_armstrongcgi.pmMatch2.28

andy_armstrongcgi.pmMatch2.29

andy_armstrongcgi.pmMatch2.30

andy_armstrongcgi.pmMatch2.31

andy_armstrongcgi.pmMatch2.32

andy_armstrongcgi.pmMatch2.33

andy_armstrongcgi.pmMatch2.34

andy_armstrongcgi.pmMatch2.35

andy_armstrongcgi.pmMatch2.36

andy_armstrongcgi.pmMatch2.37

andy_armstrongcgi.pmMatch2.38

andy_armstrongcgi.pmMatch2.39

andy_armstrongcgi.pmMatch2.40

andy_armstrongcgi.pmMatch2.41

andy_armstrongcgi.pmMatch2.42

andy_armstrongcgi.pmMatch2.43

andy_armstrongcgi.pmMatch2.44

andy_armstrongcgi.pmMatch2.45

andy_armstrongcgi.pmMatch2.46

andy_armstrongcgi.pmMatch2.47

andy_armstrongcgi.pmMatch2.48

andy_armstrongcgi.pmMatch2.49

andy_armstrongcgi.pmMatch2.50

andy_armstrongcgi.pmMatch2.51

andy_armstrongcgi.pmMatch2.52

andy_armstrongcgi.pmMatch2.53

andy_armstrongcgi.pmMatch2.54

andy_armstrongcgi.pmMatch2.55

andy_armstrongcgi.pmMatch2.56

andy_armstrongcgi.pmMatch2.57

andy_armstrongcgi.pmMatch2.58

andy_armstrongcgi.pmMatch2.59

andy_armstrongcgi.pmMatch2.60

andy_armstrongcgi.pmMatch2.61

andy_armstrongcgi.pmMatch2.62

andy_armstrongcgi.pmMatch2.63

andy_armstrongcgi.pmMatch2.64

andy_armstrongcgi.pmMatch2.65

andy_armstrongcgi.pmMatch2.66

andy_armstrongcgi.pmMatch2.67

andy_armstrongcgi.pmMatch2.68

andy_armstrongcgi.pmMatch2.69

andy_armstrongcgi.pmMatch2.70

andy_armstrongcgi.pmMatch2.71

andy_armstrongcgi.pmMatch2.72

andy_armstrongcgi.pmMatch2.73

andy_armstrongcgi.pmMatch2.74

andy_armstrongcgi.pmMatch2.75

andy_armstrongcgi.pmMatch2.76

andy_armstrongcgi.pmMatch2.77

andy_armstrongcgi.pmMatch2.78

andy_armstrongcgi.pmMatch2.79

andy_armstrongcgi.pmMatch2.80

andy_armstrongcgi.pmMatch2.81

andy_armstrongcgi.pmMatch2.82

andy_armstrongcgi.pmMatch2.83

andy_armstrongcgi.pmMatch2.84

andy_armstrongcgi.pmMatch2.85

andy_armstrongcgi.pmMatch2.86

andy_armstrongcgi.pmMatch2.87

andy_armstrongcgi.pmMatch2.88

andy_armstrongcgi.pmMatch2.89

andy_armstrongcgi.pmMatch2.90

andy_armstrongcgi.pmMatch2.91

andy_armstrongcgi.pmMatch2.92

andy_armstrongcgi.pmMatch2.93

andy_armstrongcgi.pmMatch2.94

andy_armstrongcgi.pmMatch2.95

andy_armstrongcgi.pmMatch2.96

andy_armstrongcgi.pmMatch2.97

andy_armstrongcgi.pmMatch2.98

andy_armstrongcgi.pmMatch2.99

andy_armstrongcgi.pmMatch2.751

andy_armstrongcgi.pmMatch2.752

andy_armstrongcgi.pmMatch3.00

andy_armstrongcgi.pmMatch3.01

andy_armstrongcgi.pmMatch3.02

andy_armstrongcgi.pmMatch3.03

andy_armstrongcgi.pmMatch3.04

andy_armstrongcgi.pmMatch3.05

andy_armstrongcgi.pmMatch3.06

andy_armstrongcgi.pmMatch3.07

andy_armstrongcgi.pmMatch3.08

andy_armstrongcgi.pmMatch3.09

andy_armstrongcgi.pmMatch3.10

andy_armstrongcgi.pmMatch3.11

andy_armstrongcgi.pmMatch3.12

andy_armstrongcgi.pmMatch3.13

andy_armstrongcgi.pmMatch3.14

andy_armstrongcgi.pmMatch3.15

andy_armstrongcgi.pmMatch3.16

andy_armstrongcgi.pmMatch3.17

andy_armstrongcgi.pmMatch3.18

andy_armstrongcgi.pmMatch3.19

andy_armstrongcgi.pmMatch3.20

andy_armstrongcgi.pmMatch3.21

andy_armstrongcgi.pmMatch3.22

andy_armstrongcgi.pmMatch3.23

andy_armstrongcgi.pmMatch3.24

andy_armstrongcgi.pmMatch3.25

andy_armstrongcgi.pmMatch3.26

andy_armstrongcgi.pmMatch3.27

andy_armstrongcgi.pmMatch3.28

andy_armstrongcgi.pmMatch3.29

andy_armstrongcgi.pmMatch3.30

andy_armstrongcgi.pmMatch3.31

andy_armstrongcgi.pmMatch3.32

andy_armstrongcgi.pmMatch3.33

andy_armstrongcgi.pmMatch3.34

andy_armstrongcgi.pmMatch3.35

andy_armstrongcgi.pmMatch3.36

andy_armstrongcgi.pmMatch3.37

andy_armstrongcgi.pmMatch3.38

andy_armstrongcgi.pmMatch3.39

andy_armstrongcgi.pmMatch3.40

andy_armstrongcgi.pmMatch3.41

andy_armstrongcgi.pmMatch3.42

andy_armstrongcgi.pmMatch3.43

andy_armstrongcgi.pmMatch3.44

andy_armstrongcgi.pmMatch3.45

andy_armstrongcgi.pmMatch3.46

andy_armstrongcgi.pmMatch3.47

andy_armstrongcgi.pmMatch3.48

AND

andy_armstrongcgi-simpleRange≤1.112

andy_armstrongcgi-simpleMatch0.078

andy_armstrongcgi-simpleMatch0.079

andy_armstrongcgi-simpleMatch0.080

andy_armstrongcgi-simpleMatch0.081

andy_armstrongcgi-simpleMatch0.082

andy_armstrongcgi-simpleMatch0.83

andy_armstrongcgi-simpleMatch1.0

andy_armstrongcgi-simpleMatch1.1

andy_armstrongcgi-simpleMatch1.1.1

andy_armstrongcgi-simpleMatch1.1.2

andy_armstrongcgi-simpleMatch1.103

andy_armstrongcgi-simpleMatch1.104

andy_armstrongcgi-simpleMatch1.105

andy_armstrongcgi-simpleMatch1.106

andy_armstrongcgi-simpleMatch1.107

andy_armstrongcgi-simpleMatch1.108

andy_armstrongcgi-simpleMatch1.109

andy_armstrongcgi-simpleMatch1.110

andy_armstrongcgi-simpleMatch1.111

References

cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes

kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

kb.juniper.net/InfoCenter/index?page=content&id=JSA10735

lists.fedoraproject.org/pipermail/package-announce/2011-January/053576.html

lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html

lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html

openwall.com/lists/oss-security/2010/12/01/1

openwall.com/lists/oss-security/2010/12/01/2

openwall.com/lists/oss-security/2010/12/01/3

perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm

perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1

secunia.com/advisories/43068

secunia.com/advisories/43147

www.mandriva.com/security/advisories?name=MDVSA-2010:237

www.mandriva.com/security/advisories?name=MDVSA-2010:252

www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html

www.redhat.com/support/errata/RHSA-2011-1797.html

www.securityfocus.com/bid/44199

www.securityfocus.com/bid/45145

www.vupen.com/english/advisories/2010/3230

www.vupen.com/english/advisories/2011/0212

www.vupen.com/english/advisories/2011/0249

bugzilla.redhat.com/show_bug.cgi?id=658970

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

9 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.8%

JSON

Related for NVD:CVE-2010-4410

openvas51 cve5 prion5 cvelist5 debiancve3 ubuntucve5 nessus35 f51 nvd4 securityvulns5 oraclelinux2 fedora7 centos1 redhat2 veracode2 ubuntu1 altlinux1 freebsd1 gentoo1 vmware2