The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2825 advisory.

    Mod_perl incorporates a Perl interpreter into the Apache web server, such that the Apache HTTP server can     directly execute Perl code.

    Security Fix(es):

    * mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess     (CVE-2011-2767)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - mod_perl: arbitrary Perl code execution in the context     of the user account via a user-owned .htaccess     (CVE-2011-2767)

mod_perl2 2.0.11 fixes Arbitrary Perl code execution in the context of the user account via a user-owned .htaccess.

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

This release fixes CVE-2011-2767 vulnerability (an arbitrary Perl code execution in the context of the httpd server) by disabling <Perl> sections in non-server-level configuration.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-2737 advisory.

    [2.0.4-12]
    - Fix CVE-2011-2767 (arbitrary Perl code execution in the context of the user       account via a user-owned .htaccess) (bug #1626272)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for apache2-mod_perl fixes the following issues :

Security issue fixed :

CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944).

Other issue addressed: Restore process name after sv_setpv_mg() call.
(bsc#1091625)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned     .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl     code for the administrator's control of HTTP request processing without also permitting unprivileged users     to run Perl code in the context of the user account that runs Apache HTTP Server processes.
    (CVE-2011-2767)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2826 advisory.

  - mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess     (CVE-2011-2767)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for mod_perl is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mod_perl incorporates a Perl interpreter into the Apache web server, such that the Apache HTTP server can directly execute Perl code.

Security Fix(es) :

* mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess (CVE-2011-2767)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

mod_perl allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.(CVE-2011-2767)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2737 advisory.

    Mod_perl incorporates a Perl interpreter into the Apache web server, such that the Apache HTTP server can     directly execute Perl code.

    Security Fix(es):

    * mod_perl: arbitrary Perl code execution in the context of the user account via a user-owned .htaccess     (CVE-2011-2767)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
210320	RHEL 7 : rh-perl526-mod_perl (RHSA-2018:2825)	Nessus	Red Hat Local Security Checks	11/5/2024	11/5/2024	critical
117682	Scientific Linux Security Update : mod_perl on SL6.x i386/x86_64 (20180924)	Nessus	Scientific Linux Local Security Checks	9/25/2018	8/5/2024	critical
129771	FreeBSD : mod_perl2 -- execute arbitrary Perl code (c360d057-ea8b-11e9-859b-b885849ded8e)	Nessus	FreeBSD Local Security Checks	10/10/2019	4/18/2024	critical
117374	Fedora 27 : mod_perl (2018-a94668408d)	Nessus	Fedora Local Security Checks	9/10/2018	8/8/2024	critical
117679	Oracle Linux 6 : mod_perl (ELSA-2018-2737)	Nessus	Oracle Linux Local Security Checks	9/25/2018	10/22/2024	critical
131998	SUSE SLES12 Security Update : apache2-mod_perl (SUSE-SU-2019:3213-1)	Nessus	SuSE Local Security Checks	12/12/2019	4/4/2024	critical
217533	Linux Distros Unpatched Vulnerability : CVE-2011-2767	Nessus	Misc.	3/3/2025	1/28/2026	critical
194072	RHEL 6 / 7 : rh-perl524-mod_perl (RHSA-2018:2826)	Nessus	Red Hat Local Security Checks	4/27/2024	4/27/2024	critical
117828	CentOS 6 : mod_perl (CESA-2018:2737)	Nessus	CentOS Local Security Checks	10/1/2018	2/24/2022	critical
117922	Amazon Linux AMI : mod_perl / mod24_perl (ALAS-2018-1085)	Nessus	Amazon Linux Local Security Checks	10/5/2018	2/10/2022	critical
117681	RHEL 6 : mod_perl (RHSA-2018:2737)	Nessus	Red Hat Local Security Checks	9/25/2018	11/5/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical