The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Fast_cgi | Fast_cgi_project | 0.70 (including) | 0.73 (including) |
| Libfcgi-perl | Ubuntu | maverick | * |
| Libfcgi-perl | Ubuntu | natty | * |
| Libfcgi-perl | Ubuntu | oneiric | * |
| Libfcgi-perl | Ubuntu | upstream | * |