Perl CGI. pm 'set-cookies' and 'p3p' header HTTP Injection Vulnerabilities

Release date:
Updated on:

Affected Systems:
Perl CGI. pm 3.63
Description:
--------------------------------------------------------------------------------
Bugtraq id: 56562
Cve id: CVE-2012-5526

Perl CGI. pm is a commonly used Perl module for compiling CGI Web applications.

A security vulnerability exists in CGI. pm v3.63 and earlier versions. Attackers can exploit this vulnerability to inject arbitrary HTTP headers to the server for response, resulting in Cross-Site Request Forgery and cross-site scripting.

<* Source: anazawa
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Perl
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.perl.com