Vulnerabilities > CVE-2007-1349 - Improper Input Validation vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Nessus
NASL family Solaris Local Security Checks NASL id SOLARIS10_122911.NASL description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16 This plugin has been deprecated and either replaced with individual 122911 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22060 published 2006-07-18 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22060 title Solaris 10 (sparc) : 122911-37 (deprecated) code # # (C) Tenable Network Security, Inc. # # @DEPRECATED@ # # Disabled on 2018/03/12. Deprecated and either replaced by # individual patch-revision plugins, or has been deemed a # non-security advisory. # include("compat.inc"); if (description) { script_id(22060); script_version("1.57"); script_cvs_date("Date: 2018/07/30 13:40:15"); script_cve_id("CVE-2007-1349", "CVE-2008-5519", "CVE-2009-0796"); script_name(english:"Solaris 10 (sparc) : 122911-37 (deprecated)"); script_summary(english:"Check for patch 122911-37"); script_set_attribute( attribute:"synopsis", value:"This plugin has been deprecated." ); script_set_attribute( attribute:"description", value: "SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16 This plugin has been deprecated and either replaced with individual 122911 patch-revision plugins, or deemed non-security related." ); script_set_attribute( attribute:"see_also", value:"https://getupdates.oracle.com/readme/122911-37" ); script_set_attribute( attribute:"solution", value:"n/a" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_cwe_id(79, 200, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris"); script_set_attribute(attribute:"patch_publication_date", value:"2016/03/29"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/07/18"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } exit(0, "This plugin has been deprecated. Consult specific patch-revision plugins for patch 122911 instead.");
NASL family Solaris Local Security Checks NASL id SOLARIS10_122911-35.NASL description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Nov/12/15 last seen 2020-06-01 modified 2020-06-02 plugin id 107384 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107384 title Solaris 10 (sparc) : 122911-35 code # # (C) Tenable Network Security, Inc. # # The descriptive text in this plugin was # extracted from the Oracle SunOS Patch Updates. # include("compat.inc"); if (description) { script_id(107384); script_version("1.4"); script_cvs_date("Date: 2020/01/08"); script_cve_id("CVE-2007-1349", "CVE-2008-5519", "CVE-2009-0795", "CVE-2009-0796"); script_name(english:"Solaris 10 (sparc) : 122911-35"); script_summary(english:"Check for patch 122911-35"); script_set_attribute( attribute:"synopsis", value:"The remote host is missing Sun Security Patch number 122911-35" ); script_set_attribute( attribute:"description", value: "SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Nov/12/15" ); script_set_attribute( attribute:"see_also", value:"https://getupdates.oracle.com/readme/122911-35" ); script_set_attribute(attribute:"solution", value:"Install patch 122911-35 or higher"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2007-1349"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(79, 200, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:solaris:10:122911"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:solaris:10"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/03/30"); script_set_attribute(attribute:"patch_publication_date", value:"2015/11/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/03/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Solaris Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("solaris.inc"); showrev = get_kb_item("Host/Solaris/showrev"); if (empty_or_null(showrev)) audit(AUDIT_OS_NOT, "Solaris"); os_ver = pregmatch(pattern:"Release: (\d+.(\d+))", string:showrev); if (empty_or_null(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Solaris"); full_ver = os_ver[1]; os_level = os_ver[2]; if (full_ver != "5.10") audit(AUDIT_OS_NOT, "Solaris 10", "Solaris " + os_level); package_arch = pregmatch(pattern:"Application architecture: (\w+)", string:showrev); if (empty_or_null(package_arch)) audit(AUDIT_UNKNOWN_ARCH); package_arch = package_arch[1]; if (package_arch != "sparc") audit(AUDIT_ARCH_NOT, "sparc", package_arch); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"122911-35", obsoleted_by:"", package:"SUNWapchS", version:"11.10.0,REV=2005.01.08.05.16") < 0) flag++; if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"122911-35", obsoleted_by:"", package:"SUNWapchd", version:"11.10.0,REV=2005.01.08.05.16") < 0) flag++; if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"122911-35", obsoleted_by:"", package:"SUNWapchr", version:"11.10.0,REV=2005.01.08.05.16") < 0) flag++; if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"122911-35", obsoleted_by:"", package:"SUNWapchu", version:"11.10.0,REV=2005.01.08.05.16") < 0) flag++; if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"122911-35", obsoleted_by:"", package:"SUNWtcatS", version:"11.10.0,REV=2005.01.08.05.16") < 0) flag++; if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"122911-35", obsoleted_by:"", package:"SUNWtcatr", version:"11.10.0,REV=2005.01.08.05.16") < 0) flag++; if (solaris_check_patch(release:"5.10", arch:"sparc", patch:"122911-35", obsoleted_by:"", package:"SUNWtcatu", version:"11.10.0,REV=2005.01.08.05.16") < 0) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : solaris_get_report() ); } else { patch_fix = solaris_patch_fix_get(); if (!empty_or_null(patch_fix)) audit(AUDIT_PATCH_INSTALLED, patch_fix, "Solaris 10"); tested = solaris_pkg_tests_get(); if (!empty_or_null(tested)) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); audit(AUDIT_PACKAGE_NOT_INSTALLED, "SUNWapchS / SUNWapchd / SUNWapchr / SUNWapchu / SUNWtcatS / etc"); }
NASL family Fedora Local Security Checks NASL id FEDORA_2007-577.NASL description This update fixes a security issue in mod_perl. An issue was found in the last seen 2020-06-01 modified 2020-06-02 plugin id 25471 published 2007-06-12 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25471 title Fedora Core 6 : mod_perl-2.0.2-6.2.fc6 (2007-577) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2007-577. # include("compat.inc"); if (description) { script_id(25471); script_version ("1.14"); script_cvs_date("Date: 2019/08/02 13:32:26"); script_xref(name:"FEDORA", value:"2007-577"); script_name(english:"Fedora Core 6 : mod_perl-2.0.2-6.2.fc6 (2007-577)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora Core host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update fixes a security issue in mod_perl. An issue was found in the 'namespace_from_uri' method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service. (CVE-2007-1349) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); # https://lists.fedoraproject.org/pipermail/package-announce/2007-June/001937.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?d3ecc12e" ); script_set_attribute( attribute:"solution", value: "Update the affected mod_perl, mod_perl-debuginfo and / or mod_perl-devel packages." ); script_set_attribute(attribute:"risk_factor", value:"High"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mod_perl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mod_perl-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mod_perl-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:6"); script_set_attribute(attribute:"patch_publication_date", value:"2007/06/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2007/06/12"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 6.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC6", reference:"mod_perl-2.0.2-6.2.fc6")) flag++; if (rpm_check(release:"FC6", reference:"mod_perl-debuginfo-2.0.2-6.2.fc6")) flag++; if (rpm_check(release:"FC6", reference:"mod_perl-devel-2.0.2-6.2.fc6")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mod_perl / mod_perl-debuginfo / mod_perl-devel"); }
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0486.NASL description Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache HTTP server can directly execute Perl code. The Apache::PerlRun module was found to not properly escape PATH_INFO before being used in a regular expression. If a server is configured to use Apache::PerlRun, an attacker could request a carefully crafted URI causing resource consumption, which could lead to a denial of service (CVE-2007-1349). Users of mod_perl should update to these erratum packages which contain a backported fix to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 25539 published 2007-06-18 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25539 title RHEL 2.1 : mod_perl (RHSA-2007:0486) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0627.NASL description Red Hat Network Proxy Server version 5.1.1 is now available. This update includes a fix for a security issue in a Red Hat Network Proxy Server component. This update has been rated as having low security impact by the Red Hat Security Response Team. The Red Hat Network Proxy Server 5.1.1 release corrects a security vulnerability in a shipped component. In a typical operating environment, this component is not exposed to users of Proxy Server in a vulnerable manner. This security update will reduce risk in unique Proxy Server environments. A flaw was found in the mod_perl last seen 2020-06-01 modified 2020-06-02 plugin id 63859 published 2013-01-24 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/63859 title RHEL 4 : Proxy Server (RHSA-2008:0627) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0261.NASL description Red Hat Network Satellite Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components. This update has been rated as having moderate security impact by the Red Hat Security Response Team. During an internal security review, a cross-site scripting flaw was found that affected the Red Hat Network channel search feature. (CVE-2007-5961) This release also corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306) Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789) Two arbitrary code execution flaws were fixed in the OpenMotif package. (CVE-2005-3964, CVE-2005-0605) A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898) Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510) Users of Red Hat Network Satellite Server 5.0 are advised to upgrade to 5.0.2, which resolves these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43835 published 2010-01-10 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43835 title RHEL 4 : Satellite Server (RHSA-2008:0261) NASL family Solaris Local Security Checks NASL id SOLARIS10_122911-34.NASL description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/13/15 last seen 2020-06-01 modified 2020-06-02 plugin id 107383 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107383 title Solaris 10 (sparc) : 122911-34 NASL family Fedora Local Security Checks NASL id FEDORA_2007-576.NASL description This update fixes a security issue in mod_perl. An issue was found in the last seen 2020-06-01 modified 2020-06-02 plugin id 25470 published 2007-06-12 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25470 title Fedora Core 5 : mod_perl-2.0.2-5.2.fc5 (2007-576) NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_122912-33.NASL description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/15/14 last seen 2020-06-01 modified 2020-06-02 plugin id 107884 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107884 title Solaris 10 (x86) : 122912-33 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0263.NASL description Red Hat Network Proxy Server version 5.0.2 is now available. This update includes fixes for a number of security issues in Red Hat Network Proxy Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. The Red Hat Network Proxy Server 5.0.2 release corrects several security vulnerabilities in several shipped components. In a typical operating environment, these components are not exposed to users of Proxy Server in a vulnerable manner. These security updates will reduce risk in unique Proxy Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting or denial-of-service attack. (CVE-2007-6388, CVE-2007-5000, CVE-2007-3304, CVE-2006-5752) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Users of Red Hat Network Proxy Server 5.0 are advised to upgrade to 5.0.2, which resolves these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 63853 published 2013-01-24 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/63853 title RHEL 4 : Proxy Server (RHSA-2008:0263) NASL family Solaris Local Security Checks NASL id SOLARIS10_122911-32.NASL description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/11/13 last seen 2020-06-01 modified 2020-06-02 plugin id 107381 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107381 title Solaris 10 (sparc) : 122911-32 NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_122912-37.NASL description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16 last seen 2020-06-01 modified 2020-06-02 plugin id 107888 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107888 title Solaris 10 (x86) : 122912-37 NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_122912-32.NASL description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/11/13 last seen 2020-06-01 modified 2020-06-02 plugin id 107883 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107883 title Solaris 10 (x86) : 122912-32 NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_122912-36.NASL description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/02/16 last seen 2020-06-01 modified 2020-06-02 plugin id 107887 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107887 title Solaris 10 (x86) : 122912-36 NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-488-1.NASL description Alex Solovey discovered that mod_perl did not correctly validate certain regular expression matches. A remote attacker could send a specially crafted request to a web application using mod_perl, causing the web server to monopolize CPU resources. This could lead to a remote denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 28089 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28089 title Ubuntu 6.06 LTS / 6.10 / 7.04 : libapache2-mod-perl2 vulnerability (USN-488-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0523.NASL description Red Hat Network Proxy Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Proxy Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. The Red Hat Network Proxy Server 4.2.3 release corrects several security vulnerabilities in several shipped components. In a typical operating environment, these components are not exposed to users of Proxy Server in a vulnerable manner. These security updates will reduce risk in unique Proxy Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting or denial-of-service attack. (CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752, CVE-2006-3918, CVE-2005-3352) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 63857 published 2013-01-24 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/63857 title RHEL 3 / 4 : Proxy Server (RHSA-2008:0523) NASL family Solaris Local Security Checks NASL id SOLARIS10_122911-36.NASL description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/02/16 last seen 2020-06-01 modified 2020-06-02 plugin id 107385 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107385 title Solaris 10 (sparc) : 122911-36 NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200705-04.NASL description The remote host is affected by the vulnerability described in GLSA-200705-04 (Apache mod_perl: Denial of Service) Alex Solvey discovered that the last seen 2020-06-01 modified 2020-06-02 plugin id 25154 published 2007-05-03 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25154 title GLSA-200705-04 : Apache mod_perl: Denial of Service NASL family Fedora Local Security Checks NASL id FEDORA_2007-0316.NASL description This update fixes a security issue in mod_perl. An issue was found in the last seen 2020-06-01 modified 2020-06-02 plugin id 27658 published 2007-11-06 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27658 title Fedora 7 : mod_perl-2.0.3-9.1.fc7 (2007-0316) NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_122912.NASL description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16 This plugin has been deprecated and either replaced with individual 122912 patch-revision plugins, or deemed non-security related. last seen 2019-02-21 modified 2018-07-30 plugin id 22063 published 2006-07-18 reporter Tenable source https://www.tenable.com/plugins/index.php?view=single&id=22063 title Solaris 10 (x86) : 122912-37 (deprecated) NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_122912-35.NASL description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Nov/12/15 last seen 2020-06-01 modified 2020-06-02 plugin id 107886 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107886 title Solaris 10 (x86) : 122912-35 NASL family Solaris Local Security Checks NASL id SOLARIS9_113146.NASL description SunOS 5.9: Apache Security Patch. Date this patch was last updated by Sun : Mar/05/10 last seen 2020-06-01 modified 2020-06-02 plugin id 13530 published 2004-07-12 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/13530 title Solaris 9 (sparc) : 113146-13 NASL family Solaris Local Security Checks NASL id SOLARIS8_116973.NASL description SunOS 5.8: Apache Patch. Date this patch was last updated by Sun : Apr/24/08 last seen 2020-06-01 modified 2020-06-02 plugin id 15482 published 2004-10-17 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15482 title Solaris 8 (sparc) : 116973-07 NASL family Scientific Linux Local Security Checks NASL id SL_20070614_MOD_PERL_ON_SL5_X.NASL description An issue was found in the last seen 2020-06-01 modified 2020-06-02 plugin id 60211 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60211 title Scientific Linux Security Update : mod_perl on SL5.x, SL4.x, SL3.x i386/x86_64 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0524.NASL description Red Hat Network Satellite Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. This release corrects several security vulnerabilities in various components shipped as part of the Red Hat Network Satellite Server 4.2. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting, denial-of-service, or information disclosure attacks. (CVE-2004-0885, CVE-2006-5752, CVE-2006-7197, CVE-2007-1860, CVE-2007-3304, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388) A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329) Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306) Multiple flaws were fixed in the IBM Java 1.4.2 Runtime. (CVE-2007-0243, CVE-2007-2435, CVE-2007-2788, CVE-2007-2789) Multiple flaws were fixed in the OpenMotif package. (CVE-2004-0687, CVE-2004-0688, CVE-2004-0914, CVE-2005-3964, CVE-2005-0605) A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898) Multiple flaws were fixed in the Tomcat package. (CVE-2008-0128, CVE-2007-5461, CVE-2007-3385, CVE-2007-3382, CVE-2007-1358, CVE-2007-1355, CVE-2007-2450, CVE-2007-2449, CVE-2007-0450, CVE-2006-7196, CVE-2006-7195, CVE-2006-3835, CVE-2006-0254, CVE-2005-2090, CVE-2005-4838, CVE-2005-3510) Users of Red Hat Network Satellite Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43837 published 2010-01-10 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43837 title RHEL 3 / 4 : Satellite Server (RHSA-2008:0524) NASL family SuSE Local Security Checks NASL id SUSE9_11496.NASL description Insufficient quoting of special characters in the PATH_INFO variable could lead to excessive ressource consumption and a denial of service via a specially crafted URL. (CVE-2007-1349) last seen 2020-06-01 modified 2020-06-02 plugin id 41127 published 2009-09-24 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/41127 title SuSE9 Security Update : mod_perl (YOU Patch Number 11496) NASL family Solaris Local Security Checks NASL id SOLARIS8_X86_116974.NASL description SunOS 5.8_x86: Apache Patch. Date this patch was last updated by Sun : Apr/23/08 last seen 2020-06-01 modified 2020-06-02 plugin id 15483 published 2004-10-17 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/15483 title Solaris 8 (x86) : 116974-07 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0395.NASL description Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. An issue was found in the last seen 2020-06-01 modified 2020-06-02 plugin id 25519 published 2007-06-14 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25519 title RHEL 3 / 4 / 5 : mod_perl (RHSA-2007:0395) NASL family Solaris Local Security Checks NASL id SOLARIS10_X86_122912-34.NASL description SunOS 5.10_x86: Apache 1.3 Patch. Date this patch was last updated by Sun : Jul/13/15 last seen 2020-06-01 modified 2020-06-02 plugin id 107885 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107885 title Solaris 10 (x86) : 122912-34 NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2007-0395.NASL description Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. An issue was found in the last seen 2020-06-01 modified 2020-06-02 plugin id 25526 published 2007-06-18 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25526 title CentOS 3 / 4 / 5 : mod_perl (CESA-2007:0395) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2007-0395.NASL description From Red Hat Security Advisory 2007:0395 : Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Mod_perl incorporates a Perl interpreter into the Apache web server, so that the Apache web server can directly execute Perl code. An issue was found in the last seen 2020-06-01 modified 2020-06-02 plugin id 67508 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67508 title Oracle Linux 3 / 4 / 5 : mod_perl (ELSA-2007-0395) NASL family Solaris Local Security Checks NASL id SOLARIS10_122911-33.NASL description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/15/14 last seen 2020-06-01 modified 2020-06-02 plugin id 107382 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107382 title Solaris 10 (sparc) : 122911-33 NASL family Solaris Local Security Checks NASL id SOLARIS9_X86_114145.NASL description SunOS 5.9_x86: Apache Security Patch. Date this patch was last updated by Sun : Mar/05/10 last seen 2020-06-01 modified 2020-06-02 plugin id 13593 published 2004-07-12 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/13593 title Solaris 9 (x86) : 114145-12 NASL family Solaris Local Security Checks NASL id SOLARIS10_122911-37.NASL description SunOS 5.10: Apache 1.3 Patch. Date this patch was last updated by Sun : Mar/29/16 last seen 2020-06-01 modified 2020-06-02 plugin id 107386 published 2018-03-12 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/107386 title Solaris 10 (sparc) : 122911-37 NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0630.NASL description Red Hat Network Satellite Server version 5.1.1 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components. This update has been rated as having low security impact by the Red Hat Security Response Team. During an internal security audit, it was discovered that Red Hat Network Satellite Server shipped with an XML-RPC script, manzier.pxt, which had a single hard-coded authentication key. A remote attacker who is able to connect to the Satellite Server XML-RPC service could use this flaw to obtain limited information about Satellite Server users, such as login names, associated email addresses, internal user IDs, and partial information about entitlements. (CVE-2008-2369) This release also corrects several security vulnerabilities in various components shipped as part of Red Hat Network Satellite Server 5.1. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306) A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898) Multiple flaws were fixed in the Apache Tomcat package. (CVE-2005-4838, CVE-2006-0254, CVE-2007-1355, CVE-2007-1358, CVE-2007-2449, CVE-2007-5461, CVE-2008-0128) Users of Red Hat Network Satellite Server 5.1 are advised to upgrade to 5.1.1, which resolves these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43840 published 2010-01-10 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43840 title RHEL 4 : Satellite Server (RHSA-2008:0630) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_EF2FFB03F2B011DBAD250010B5A0A860.NASL description Mandriva reports : PerlRun.pm in Apache mod_perl 1.29 and earlier, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. last seen 2020-06-01 modified 2020-06-02 plugin id 25103 published 2007-04-30 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/25103 title FreeBSD : mod_perl -- remote DoS in PATH_INFO parsing (ef2ffb03-f2b0-11db-ad25-0010b5a0a860) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-083.NASL description PerlRun.pm in Apache mod_perl 1.30 and earlier, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. Updated packages have been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 25034 published 2007-04-12 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25034 title Mandrake Linux Security Advisory : apache-mod_perl (MDKSA-2007:083)
Oval
accepted 2013-04-29T04:10:29.086-04:00 class vulnerability contributors name Aharon Chernin organization SCAP.com, LLC name Dragos Prisaca organization G2, Inc.
definition_extensions comment The operating system installed on the system is Red Hat Enterprise Linux 3 oval oval:org.mitre.oval:def:11782 comment CentOS Linux 3.x oval oval:org.mitre.oval:def:16651 comment The operating system installed on the system is Red Hat Enterprise Linux 4 oval oval:org.mitre.oval:def:11831 comment CentOS Linux 4.x oval oval:org.mitre.oval:def:16636 comment Oracle Linux 4.x oval oval:org.mitre.oval:def:15990 comment The operating system installed on the system is Red Hat Enterprise Linux 5 oval oval:org.mitre.oval:def:11414 comment The operating system installed on the system is CentOS Linux 5.x oval oval:org.mitre.oval:def:15802 comment Oracle Linux 5.x oval oval:org.mitre.oval:def:15459
description PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. family unix id oval:org.mitre.oval:def:10987 status accepted submitted 2010-07-09T03:56:16-04:00 title PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. version 27 accepted 2010-06-07T04:01:05.430-04:00 class vulnerability contributors name Pai Peng organization Hewlett-Packard definition_extensions comment Solaris 10 (SPARC) is installed oval oval:org.mitre.oval:def:1440 comment Solaris 10 (x86) is installed oval oval:org.mitre.oval:def:1926
description PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI. family unix id oval:org.mitre.oval:def:8349 status accepted submitted 2010-03-16T15:16:58.000-04:00 title Security Vulnerabilities in the Apache 2 "mod_perl2" Module Components "PerlRun.pm" May Lead to Denial of Service (DoS) or Unauthorized Access to Data version 36
Redhat
advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
rpms |
|
References
- ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc
- ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc
- http://rhn.redhat.com/errata/RHSA-2007-0395.html
- http://rhn.redhat.com/errata/RHSA-2007-0395.html
- http://rhn.redhat.com/errata/RHSA-2008-0630.html
- http://rhn.redhat.com/errata/RHSA-2008-0630.html
- http://secunia.com/advisories/24678
- http://secunia.com/advisories/24678
- http://secunia.com/advisories/24839
- http://secunia.com/advisories/24839
- http://secunia.com/advisories/25072
- http://secunia.com/advisories/25072
- http://secunia.com/advisories/25110
- http://secunia.com/advisories/25110
- http://secunia.com/advisories/25432
- http://secunia.com/advisories/25432
- http://secunia.com/advisories/25655
- http://secunia.com/advisories/25655
- http://secunia.com/advisories/25730
- http://secunia.com/advisories/25730
- http://secunia.com/advisories/25894
- http://secunia.com/advisories/25894
- http://secunia.com/advisories/26084
- http://secunia.com/advisories/26084
- http://secunia.com/advisories/26231
- http://secunia.com/advisories/26231
- http://secunia.com/advisories/26290
- http://secunia.com/advisories/26290
- http://secunia.com/advisories/31490
- http://secunia.com/advisories/31490
- http://secunia.com/advisories/31493
- http://secunia.com/advisories/31493
- http://secunia.com/advisories/33720
- http://secunia.com/advisories/33720
- http://secunia.com/advisories/33723
- http://secunia.com/advisories/33723
- http://security.gentoo.org/glsa/glsa-200705-04.xml
- http://security.gentoo.org/glsa/glsa-200705-04.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1
- http://support.avaya.com/elmodocs2/security/ASA-2007-293.htm
- http://support.avaya.com/elmodocs2/security/ASA-2007-293.htm
- http://svn.apache.org/repos/asf/perl/modperl/branches/1.x/Changes
- http://svn.apache.org/repos/asf/perl/modperl/branches/1.x/Changes
- http://www.gossamer-threads.com/lists/modperl/modperl/92739
- http://www.gossamer-threads.com/lists/modperl/modperl/92739
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:083
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:083
- http://www.novell.com/linux/security/advisories/2007_12_sr.html
- http://www.novell.com/linux/security/advisories/2007_12_sr.html
- http://www.novell.com/linux/security/advisories/2007_8_sr.html
- http://www.novell.com/linux/security/advisories/2007_8_sr.html
- http://www.redhat.com/support/errata/RHSA-2007-0396.html
- http://www.redhat.com/support/errata/RHSA-2007-0396.html
- http://www.redhat.com/support/errata/RHSA-2007-0486.html
- http://www.redhat.com/support/errata/RHSA-2007-0486.html
- http://www.redhat.com/support/errata/RHSA-2008-0261.html
- http://www.redhat.com/support/errata/RHSA-2008-0261.html
- http://www.redhat.com/support/errata/RHSA-2008-0627.html
- http://www.redhat.com/support/errata/RHSA-2008-0627.html
- http://www.securityfocus.com/bid/23192
- http://www.securityfocus.com/bid/23192
- http://www.securitytracker.com/id?1018259
- http://www.securitytracker.com/id?1018259
- http://www.trustix.org/errata/2007/0023/
- http://www.trustix.org/errata/2007/0023/
- http://www.ubuntu.com/usn/usn-488-1
- http://www.ubuntu.com/usn/usn-488-1
- http://www.vupen.com/english/advisories/2007/1150
- http://www.vupen.com/english/advisories/2007/1150
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33312
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33312
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10987
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10987
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8349
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8349