Perl CGI-Simple 'multipart/x-mixed-replace' MIME Boundary HTTP Response Splitting Vulnerability

Bugtraq ID:	45144
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 01 2010 12:00AM
Updated:	Dec 01 2010 12:00AM
Credit:	Byron Jones, Masahiro Yamada, Reed Loden, and Mark Stosberg
Vulnerable:	Andy Armstrong CGI-Simple 1.112
Not Vulnerable:

Perl CGI-Simple 'multipart/x-mixed-replace' MIME Boundary HTTP Response Splitting Vulnerability

Perl CGI-Simple is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied input before using it in HTTP headers.

Attackers can leverage this issue to influence or misrepresent how Web content is served, cached, or interpreted. This could aid in various attacks that try to instill client users with a false sense of trust.

Perl CGI-Simple 'multipart/x-mixed-replace' MIME Boundary HTTP Response Splitting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.

Perl CGI-Simple 'multipart/x-mixed-replace' MIME Boundary HTTP Response Splitting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Perl CGI-Simple 'multipart/x-mixed-replace' MIME Boundary HTTP Response Splitting Vulnerability

References:

• CGI--Simple GIT Page (Mark Stosberg)
  
• CGI-Simple CPAN Page (Andy Armstrong)
  
• Perl Home Page (Perl)