Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2011-2766: Debian libfcgi-perl lets attackers bypass login
CVE-2011-2766 · published 15 years ago
Summary
The Fast CGI module for Perl (versions 0.70‑0.73) on Debian can reuse environment data from a previous web request when handling a new one. This mix‑up can let a remote user craft special headers to get around authentication checks. Update the libfcgi-perl package to a newer version or apply the vendor’s patch to stop the reuse of old request data.
What to do
- Update debian libfcgi-perl to version 0.73-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | libfcgi-perl |
< 0.73-2 Fix: upgrade to 0.73-2
|
| Debian:13 | debian | libfcgi-perl |
< 0.73-2 Fix: upgrade to 0.73-2
|
| Debian:14 | debian | libfcgi-perl |
< 0.73-2 Fix: upgrade to 0.73-2
|
| – | fast_cgi_project | fast_cgi |
>= 0.70, <= 0.73 cpe:2.3:a:fast_cgi_project:fast_cgi:*:*:*:*:*:perl:*:* |
| – | debian | debian_linux |
5.0 6.0 7.0 cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* |
Original advisory text
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attacker...
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
References
- https://security-tracker.debian.org/tracker/CVE-2011-2766 Vendor Advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479 Exploit Issue Tracking Mailing List Third Party Advisory
- http://www.debian.org/security/2011/dsa-2327 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:001 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2011/09/08/1 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2011/09/08/2 Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/49549 Third Party Advisory VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=736604 Exploit Issue Tracking Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69709 Third Party Advisory VDB Entry
- https://hermes.opensuse.org/messages/13154637 Broken Link
- https://hermes.opensuse.org/messages/13155253 Broken Link
- https://rt.cpan.org/Public/Bug/Display.html?id=68380 Exploit Patch Third Party Advisory
Severity
7.5
High
Type
CWE-287Improper Authentication
Timeline
Published23 Sep 2011
Updated15 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta