Conectiva Information for VU#246409

CGI.pm vulnerable to Cross-site Scripting

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------


PACKAGE   : perl
SUMMARY   : CGI.pm cross site scripting vulnerability
DATE      : 2003-07-29 14:53:00
ID        : CLA-2003:713
RELEVANT
RELEASES  : 8, 9


- -------------------------------------------------------------------------

DESCRIPTION
Perl is a high-level interpreted programming language well known for
its flexibility and ability to work with text streams.

obscure@eyeonsecurity.org reported[1] a cross site scripting
vulnerability in the CGI.pm perl module. This module is used to
facilitate the creation of web forms and is part of the perl-modules
RPM package.



SOLUTION
It is recommended that all users of the CGI.pm module upgrade their
packages.


REFERENCES
1. http://eyeonsecurity.org/advisories/CGI.pm/adv.html



UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/SRPMS/perl-5.6.1-19U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/miniperl-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-base-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-devel-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-devel-static-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-doc-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-lib-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-modules-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/perl-utils-5.6.1-19U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/perl-5.8.0-28837U90_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libperl5.8-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/miniperl-5.8.0-28837U90_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-base-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-devel-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-devel-static-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-doc-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-modules-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-suidperl-5.8.0-28837U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/perl-utils-5.8.0-28837U90_2cl.i386.rpm



ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:


 - run:                 apt-get update
- after that, execute: apt-get upgrade


 Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en


- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en


- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com


- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org


iD8DBQE/JrTl42jd0JmAcZARAtRNAJ4uB+6hcCH4ZgrT48bZDKAfAepEIACZAY1g
FFwRu7idOx17DAywH+M8UKA=
=z88h
-----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

If you have feedback, comments, or additional information about this vulnerability, please send us email.