2.6 - CVE-2011-4940

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2011-4940	First vendor Publication	2012-06-27
Vendor	Cve	Last vendor Modification	2023-02-13

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Cvss Base Score	2.6	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	High
Cvss Expoit Score	4.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4940

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20623

Oval ID:	oval:org.mitre.oval:def:20623
Title:	VMware security updates for vSphere API and ESX Service Console
Description:	The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2011-4940	Version:	4
Platform(s):	VMWare ESX Server 4.1	Product(s):
Definition Synopsis:
Patch ESX410-201211407-SG is not installed VMware ESX Server 4.1 is installed AND Patch ESX410-201211407-SG is not installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Python cpe:2.3:a:python:python:2.7.2:rc1:::::: cpe:2.3:a:python:python:2.7.1:-:::::: cpe:2.3:a:python:python:2.7.1:rc1:::::: cpe:2.3:a:python:python:2.6.6:::::::* cpe:2.3:a:python:python:2.6.5:::::::* cpe:2.3:a:python:python:2.6.4:::::::* cpe:2.3:a:python:python:2.6.3:::::::* cpe:2.3:a:python:python:2.6.2:::::::* cpe:2.3:a:python:python:2.6.1:::::::* cpe:2.3:a:python:python:2.5.6:::::::* cpe:2.3:a:python:python:2.5.5:::::::* cpe:2.3:a:python:python:2.5.4:::::::* cpe:2.3:a:python:python:2.5.3:::::::* cpe:2.3:a:python:python:2.5.2:::::::* cpe:2.3:a:python:python:2.5.1:::::::* cpe:2.3:a:python:python:2.5.0:::::::* cpe:2.3:a:python:python:2.4.6:::::::* cpe:2.3:a:python:python:2.4.5:::::::* cpe:2.3:a:python:python:2.4.4:::::::* cpe:2.3:a:python:python:2.4.3:::::::* cpe:2.3:a:python:python:2.4.2:::::::* cpe:2.3:a:python:python:2.4.1:::::::* cpe:2.3:a:python:python:2.4.0:::::::* cpe:2.3:a:python:python:2.3.7:::::::* cpe:2.3:a:python:python:2.3.6:::::::* cpe:2.3:a:python:python:2.3.5:::::::* cpe:2.3:a:python:python:2.3.4:::::::* cpe:2.3:a:python:python:2.3.3:::::::* cpe:2.3:a:python:python:2.3.2:::::::* cpe:2.3:a:python:python:2.3.1:::::::* cpe:2.3:a:python:python:2.3.0:::::::* cpe:2.3:a:python:python:2.2.3:::::::* cpe:2.3:a:python:python:2.2.2:::::::* cpe:2.3:a:python:python:2.2.1:::::::* cpe:2.3:a:python:python:2.2.0:::::::* cpe:2.3:a:python:python:2.2:::::::* cpe:2.3:a:python:python:2.1.3:::::::* cpe:2.3:a:python:python:2.1.2:::::::* cpe:2.3:a:python:python:2.1.1:::::::* cpe:2.3:a:python:python:2.1:::::::* cpe:2.3:a:python:python:2.0.1:::::::* cpe:2.3:a:python:python:2.0:::::::* cpe:2.3:a:python:python:1.6.1:::::::* cpe:2.3:a:python:python:1.6:::::::* cpe:2.3:a:python:python:1.5.2:::::::* cpe:2.3:a:python:python:1.3:::::::* cpe:2.3:a:python:python:1.2:::::::* cpe:2.3:a:python:python:0.9.1:::::::* cpe:2.3:a:python:python:0.9.0:::::::* cpe:2.3:a:python:python:::::::: cpe:2.3:a:python:python:-:::::::*	51

OpenVAS Exploits

Date	Description
2012-11-16	Name : VMSA-2012-0016: VMware security updates for vSphere API and ESX Service Console File : nvt/gb_VMSA-2012-0016.nasl
2012-10-19	Name : Ubuntu Update for python2.5 USN-1613-1 File : nvt/gb_ubuntu_USN_1613_1.nasl
2012-10-19	Name : Ubuntu Update for python2.4 USN-1613-2 File : nvt/gb_ubuntu_USN_1613_2.nasl
2012-10-05	Name : Ubuntu Update for python2.6 USN-1596-1 File : nvt/gb_ubuntu_USN_1596_1.nasl
2012-10-03	Name : Ubuntu Update for python2.7 USN-1592-1 File : nvt/gb_ubuntu_USN_1592_1.nasl
2012-07-30	Name : CentOS Update for python CESA-2012:0744 centos6 File : nvt/gb_CESA-2012_0744_python_centos6.nasl
2012-07-30	Name : CentOS Update for python CESA-2012:0745 centos5 File : nvt/gb_CESA-2012_0745_python_centos5.nasl
2012-06-22	Name : Mandriva Update for python MDVSA-2012:096 (python) File : nvt/gb_mandriva_MDVSA_2012_096.nasl
2012-06-19	Name : RedHat Update for python RHSA-2012:0744-01 File : nvt/gb_RHSA-2012_0744-01_python.nasl
2012-06-19	Name : RedHat Update for python RHSA-2012:0745-01 File : nvt/gb_RHSA-2012_0745-01_python.nasl

Information Assurance Vulnerability Management (IAVM)

Date	Description
2012-11-29	IAVM : 2012-A-0189 - Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1 Severity : Category I - VMSKEY : V0035032

Snort® IPS/IDS

Date	Description
2014-11-16	VMWare vSphere API SOAP request RetrieveProperties remote denial of service a... RuleID : 31297 - Revision : 3 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date	Description
2016-02-29	Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2012-0016_remote.nasl - Type : ACT_GATHER_INFO
2013-09-04	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-98.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0744.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0745.nasl - Type : ACT_GATHER_INFO
2012-11-16	Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2012-0016.nasl - Type : ACT_GATHER_INFO
2012-10-18	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1613-1.nasl - Type : ACT_GATHER_INFO
2012-10-18	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1613-2.nasl - Type : ACT_GATHER_INFO
2012-10-05	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1596-1.nasl - Type : ACT_GATHER_INFO
2012-10-03	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1592-1.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120618_python_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120618_python_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-06-21	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-096.nasl - Type : ACT_GATHER_INFO
2012-06-20	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0744.nasl - Type : ACT_GATHER_INFO
2012-06-19	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0745.nasl - Type : ACT_GATHER_INFO
2012-06-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0744.nasl - Type : ACT_GATHER_INFO
2012-06-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0745.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/54083
CONFIRM	http://bugs.python.org/issue11442 https://bugzilla.redhat.com/show_bug.cgi?id=803500
JVN	http://jvn.jp/en/jp/JVN51176027/index.html
JVNDB	http://jvndb.jvn.jp/jvndb/JVNDB-2012-000063
SECUNIA	http://secunia.com/advisories/50858 http://secunia.com/advisories/51024 http://secunia.com/advisories/51040
UBUNTU	http://www.ubuntu.com/usn/USN-1592-1 http://www.ubuntu.com/usn/USN-1596-1 http://www.ubuntu.com/usn/USN-1613-1 http://www.ubuntu.com/usn/USN-1613-2

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-02 01:17:54	Multiple Updates
2024-02-01 12:05:19	Multiple Updates
2023-09-05 12:16:48	Multiple Updates
2023-09-05 01:05:10	Multiple Updates
2023-09-02 12:16:53	Multiple Updates
2023-09-02 01:05:16	Multiple Updates
2023-08-12 12:20:31	Multiple Updates
2023-08-12 01:05:17	Multiple Updates
2023-08-11 12:16:59	Multiple Updates
2023-08-11 01:05:27	Multiple Updates
2023-08-06 12:16:20	Multiple Updates
2023-08-06 01:05:18	Multiple Updates
2023-08-04 12:16:24	Multiple Updates
2023-08-04 01:05:18	Multiple Updates
2023-07-14 12:16:23	Multiple Updates
2023-07-14 01:05:15	Multiple Updates
2023-03-29 01:18:21	Multiple Updates
2023-03-28 12:05:23	Multiple Updates
2023-02-13 09:28:42	Multiple Updates
2023-02-02 21:28:43	Multiple Updates
2022-10-11 12:14:38	Multiple Updates
2022-10-11 01:05:00	Multiple Updates
2021-05-04 12:18:02	Multiple Updates
2021-04-22 01:21:21	Multiple Updates
2020-05-23 01:47:42	Multiple Updates
2020-05-23 00:32:23	Multiple Updates
2018-08-14 12:04:28	Multiple Updates
2018-05-18 12:02:37	Multiple Updates
2016-06-28 18:55:58	Multiple Updates
2016-04-26 21:19:00	Multiple Updates
2016-03-01 13:26:32	Multiple Updates
2014-02-17 11:06:36	Multiple Updates
2013-11-11 12:39:40	Multiple Updates
2013-05-16 17:02:47	Multiple Updates
2013-05-10 23:12:13	Multiple Updates
2013-02-14 13:24:37	Multiple Updates
2013-01-30 13:21:08	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	51
Sources(s)	12
Openvas Exploit(s)	10
IAVM(s)	1
Snort® Rule(s)	1
Nessus® Exploit(s)	16

	Related
8.5	VMSA-2012-0016
6.9	USN-1613-2
6.9	USN-1613-1
6.9	USN-1596-1
6.4	USN-1592-1
5	RHSA-2012:0745
5	RHSA-2012:0744
5	MDVSA-2012:096-1
5	MDVSA-2012:096
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 9 more Alert(s)