Debian Security Advisory

DSA-371-1 perl -- cross-site scripting

Date Reported:

11 Aug 2003

Affected Packages:

perl

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CAN-2003-0615.

More information:

A cross-site scripting vulnerability exists in the start_form() function in CGI.pm. This function outputs user-controlled data into the action attribute of a form element without sanitizing it, allowing a remote user to execute arbitrary web script within the context of the generated page. Any program which uses this function in the CGI.pm module may be affected.

For the current stable distribution (woody) this problem has been fixed in version 5.6.1-8.3.

For the unstable distribution (sid) this problem has been fixed in version 5.8.0-19.

We recommend that you update your perl package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3.dsc

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3.diff.gz

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1.orig.tar.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.6.1-8.3_all.deb

http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.6.1-8.3_all.deb

http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.6.1-8.3_all.deb

Alpha:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_alpha.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_alpha.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_alpha.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_alpha.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_alpha.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_alpha.deb

ARM:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_arm.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_arm.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_arm.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_arm.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_arm.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_arm.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_i386.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_i386.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_i386.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_i386.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_i386.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_ia64.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_ia64.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_ia64.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_ia64.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_ia64.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_ia64.deb

HPPA:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_hppa.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_hppa.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_hppa.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_hppa.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_hppa.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_hppa.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_m68k.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_m68k.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_m68k.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_m68k.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_m68k.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_m68k.deb

Big endian MIPS:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_mips.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_mips.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_mips.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_mips.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_mips.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_mips.deb

Little endian MIPS:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_mipsel.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_mipsel.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_mipsel.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_mipsel.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_mipsel.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_powerpc.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_powerpc.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_powerpc.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_powerpc.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_powerpc.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_s390.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_s390.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_s390.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_s390.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_s390.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.6.1-8.3_sparc.deb

http://security.debian.org/pool/updates/main/p/perl/libperl5.6_5.6.1-8.3_sparc.deb

http://security.debian.org/pool/updates/main/p/perl/perl_5.6.1-8.3_sparc.deb

http://security.debian.org/pool/updates/main/p/perl/perl-base_5.6.1-8.3_sparc.deb

http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.6.1-8.3_sparc.deb

http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.6.1-8.3_sparc.deb

MD5 checksums of the listed files are available in the original advisory.