Executive Summary
| Summary | |
|---|---|
| Title | New perl packages fix cross-site scripting |
| Informations | |||
|---|---|---|---|
| Name | DSA-371 | First vendor Publication | 2003-08-11 |
| Vendor | Debian | Last vendor Modification | 2003-08-11 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A cross-site scripting vulnerability exists in the start_form() function in CGI.pm. This function outputs user-controlled data into the action attribute of a form element without sanitizing it, allowing a remote user to execute arbitrary web script within the context of the generated page. Any program which uses this function in the CGI.pm module may be affected. For the current stable distribution (woody) this problem has been fixed in version 5.6.1-8.3. For the unstable distribution (sid) this problem has been fixed in version 5.8.0-19. We recommend that you update your perl package. |
Original Source
| Url : http://www.debian.org/security/2003/dsa-371 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:307 | |||
| Oval ID: | oval:org.mitre.oval:def:307 | ||
| Title: | CGI.pm start_form Cross-Site Scripting Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2003-0615 | Version: | 3 |
| Platform(s): | Sun Solaris 8 Sun Solaris 9 | Product(s): | Perl |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:470 | |||
| Oval ID: | oval:org.mitre.oval:def:470 | ||
| Title: | CGI.pm Cross-site Scripting Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web script via a URL that is fed into the form's action parameter. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2003-0615 | Version: | 2 |
| Platform(s): | Red Hat Linux 9 | Product(s): | CGI.pm |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-06-03 | Name : Solaris Update for Perl 119449-01 File : nvt/gb_solaris_119449_01.nasl |
| 2009-06-03 | Name : Solaris Update for Perl 119450-01 File : nvt/gb_solaris_119450_01.nasl |
| 2009-06-03 | Name : Solaris Update for S9 perl 5.005_03`s CGI.pm and Safe.pm modules 121996-01 File : nvt/gb_solaris_121996_01.nasl |
| 2009-06-03 | Name : Solaris Update for S9 perl 5.005_03`s CGI.pm and Safe.pm modules 121997-02 File : nvt/gb_solaris_121997_02.nasl |
| 2009-06-03 | Name : Solaris Update for perl 122091-01 File : nvt/gb_solaris_122091_01.nasl |
| 2009-06-03 | Name : Solaris Update for perl 122092-01 File : nvt/gb_solaris_122092_01.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 371-1 (perl) File : nvt/deb_371_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 6347 | CGI.pm Multiple Function XSS CGI.pm contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate $action variables upon submission to the startform() script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-371.nasl - Type : ACT_GATHER_INFO |
| 2004-07-31 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2003-084.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2003-257.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:32:51 |
|
