CVE-2011-2767
Publication date 26 August 2018
Last updated 24 July 2024
Ubuntu priority
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libapache2-mod-perl2 | ||
| 18.04 LTS bionic |
Fixed 2.0.10-2ubuntu3.18.04.1
|
|
| 16.04 LTS xenial |
Fixed 2.0.9-4ubuntu1.2
|
|
| 14.04 LTS trusty |
Fixed 2.0.8+httpd24-r1449661-6ubuntu2.1
|
Patch details
| Package | Patch details |
|---|---|
| libapache2-mod-perl2 |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
9.8 · Critical
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3825-2
- mod_perl vulnerability
- 22 November 2018
- USN-3825-1
- mod_perl vulnerability
- 21 November 2018