Test ID:	1.3.6.1.4.1.25623.1.0.53659
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 371-1 (perl)
Summary:	The remote host is missing an update to perl;announced via advisory DSA 371-1.
Description:	Summary: The remote host is missing an update to perl announced via advisory DSA 371-1. Vulnerability Insight: A cross-site scripting vulnerability exists in the start_form() function in CGI.pm. This function outputs user-controlled data into the action attribute of a form element without sanitizing it, allowing a remote user to execute arbitrary web script within the context of the generated page. Any program which uses this function in the CGI.pm module may be affected. For the current stable distribution (woody) this problem has been fixed in version 5.6.1-8.3. For the unstable distribution (sid) this problem has been fixed in version 5.8.0-19. We recommend that you update your perl package. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0615 BugTraq ID: 8231 http://www.securityfocus.com/bid/8231 Bugtraq: 20030720 CGI.pm vulnerable to Cross-site Scripting (Google Search) http://marc.info/?l=bugtraq&m=105880349328877&w=2 Bugtraq: 20030806 [OpenPKG-SA-2003.036] OpenPKG Security Advisory (perl-www) (Google Search) http://marc.info/?l=bugtraq&m=106018783704468&w=2 CERT/CC vulnerability note: VU#246409 http://www.kb.cert.org/vuls/id/246409 Computer Incident Advisory Center Bulletin: N-155 http://www.ciac.org/ciac/bulletins/n-155.shtml Conectiva Linux advisory: CLA-2003:713 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000713 Debian Security Information: DSA-371 (Google Search) http://www.debian.org/security/2003/dsa-371 http://marc.info/?l=full-disclosure&m=105875211018698&w=2 http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2003:084 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A307 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A470 http://www.redhat.com/support/errata/RHSA-2003-256.html SCO Security Bulletin: CSSA-2003-SCO.30 http://securitytracker.com/id?1007234 http://secunia.com/advisories/13638 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101426-1 XForce ISS Database: cgi-startform-xss(12669) https://exchange.xforce.ibmcloud.com/vulnerabilities/12669
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.