CVE-2007-1349

Apache mod_perl < 1.30 - Denial of Service via PATH_INFO Regular Expression

Title source: llm
STIX 2.1

Description

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

References (39)

Core 39
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26231
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018259
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25894
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2008-0630.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2007-0395.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0486.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31493
Third Party Advisory x_refsource_misc
http://www.gossamer-threads.com/lists/modperl/modperl/92739
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0627.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24839
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33720
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-488-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31490
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_12_sr.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26084
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/1150
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25655
Broken Link vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1
Third Party Advisory x_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2007-293.htm
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24678
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25110
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0396.html
Broken Link vendor-advisory x_refsource_trustix
http://www.trustix.org/errata/2007/0023/
Third Party Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDKSA-2007:083
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33723
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25730
Broken Link vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_8_sr.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26290
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/33312
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0261.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200705-04.xml
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/23192
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25072
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25432
Broken Link vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1

Scores

EPSS 0.1011
EPSS Percentile 95.1%

Details

CWE
CWE-20
Status published
Products (15)
apache/mod_perl < 1.30
canonical/ubuntu_linux 6.06
canonical/ubuntu_linux 6.10
canonical/ubuntu_linux 7.04
redhat/enterprise_linux_desktop 3.0
redhat/enterprise_linux_desktop 4.0
redhat/enterprise_linux_desktop 5.0
redhat/enterprise_linux_eus 4.5
redhat/enterprise_linux_server 3.0
redhat/enterprise_linux_server 4.0
... and 5 more
Published Mar 30, 2007
Tracked Since Feb 18, 2026