Design Error in libhttp-body-perl
Summary
DSA-2801-1: libhttp-body-perl - design error. Affects libhttp-body-perl versions < 1.11-1+deb7u1. Fixed in 1.11-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhttp-body-perl is a Perl module used for processing data from HTTP POST requests. It includes a multipart parser that creates temporary files to handle uploaded files. These temporary files retain the suffix of the uploaded file. However, a design error in the HTTP body multipart parser can lead to potential command execution on the server if these temporary filenames are used in subsequent commands without proper checks.
Vulnerability Detail
The vulnerability in libhttp-body-perl arises from the creation of temporary files with preserved suffixes. An attacker who can upload files to a service utilizing HTTP::Body::Multipart can exploit this issue to execute arbitrary commands on the server. By manipulating the temporary filenames and bypassing further checks, the attacker can gain unauthorized access and potentially compromise the entire system.
How To Fix
Minimum fixed version
1.11-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhttp-body-perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The design error in libhttp-body-perl can be exploited by an attacker to execute arbitrary commands on the server. It is crucial to upgrade to the fixed version of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libhttp-body-perl →
FAQ
libhttp-body-perl is a Perl module used for processing data from HTTP POST requests.
The vulnerability allows an attacker to execute arbitrary commands on the server, potentially leading to unauthorized access and compromise of the system.
To fix this vulnerability, upgrade the libhttp-body-perl package to version 1.11-1+deb7u1 or later.
No specific workaround has been mentioned for this vulnerability.
For more information, you can refer to the Debian Security Advisory DSA-2801-1.
Related vulnerabilities
Recent vulnerabilities recorded for libhttp-body-perl.
