CVE-2011-2767

NameCVE-2011-2767
Descriptionmod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1507-1
NVD severityhigh (attack range: remote)
Debian Bugs644169

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libapache2-mod-perl2 (PTS)jessie2.0.9~1624218-2+deb8u2vulnerable
jessie (security)2.0.9~1624218-2+deb8u3fixed
stretch2.0.10-2+deb9u1fixed
buster, sid2.0.10-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libapache2-mod-perl2source(unstable)2.0.10-3high644169
libapache2-mod-perl2sourcejessie2.0.9~1624218-2+deb8u3highDLA-1507-1
libapache2-mod-perl2sourcestretch2.0.10-2+deb9u1high

Notes

https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E
https://rt.cpan.org/Public/Bug/Display.html?id=126984
https://bugzilla.redhat.com/show_bug.cgi?id=1623265#c3

Search for package or bug name: Reporting problems