{"id": "SECURITYVULNS:DOC:31955", "bulletinFamily": "software", "title": "[ MDVSA-2015:226 ] fcgi", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n _______________________________________________________________________\r\n\r\n Mandriva Linux Security Advisory MDVSA-2015:226\r\n http://www.mandriva.com/en/support/security/\r\n _______________________________________________________________________\r\n\r\n Package : fcgi\r\n Date : May 4, 2015\r\n Affected: Business Server 1.0\r\n _______________________________________________________________________\r\n\r\n Problem Description:\r\n\r\n Updated fcgi packages fix security vulnerability:\r\n \r\n FCGI does not perform range checks for file descriptors before use of\r\n the FD_SET macro. This FD_SET macro could allow for more than 1024\r\n total file descriptors to be monitored in the closing state. This\r\n may allow remote attackers to cause a denial of service (stack memory\r\n corruption, and infinite loop or daemon crash) by opening many socket\r\n connections to the host and crashing the service (CVE-2012-6687).\r\n _______________________________________________________________________\r\n\r\n References:\r\n\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6687\r\n http://advisories.mageia.org/MGASA-2015-0184.html\r\n _______________________________________________________________________\r\n\r\n Updated Packages:\r\n\r\n Mandriva Business Server 1/X86_64:\r\n 91a51dbbc00041b1a870210b5a70582b mbs1/x86_64/fcgi-2.4.0-12.1.mbs1.x86_64.rpm\r\n bd253938ad248b68a1473346e68f555a mbs1/x86_64/lib64fcgi0-2.4.0-12.1.mbs1.x86_64.rpm\r\n 721f968b1d78634ea0e2ed1c2ae0d5af mbs1/x86_64/lib64fcgi0-devel-2.4.0-12.1.mbs1.x86_64.rpm \r\n 7a3a9efd00820383fa932d0743ea5539 mbs1/SRPMS/fcgi-2.4.0-12.1.mbs1.src.rpm\r\n _______________________________________________________________________\r\n\r\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\r\n of md5 checksums and GPG signatures is performed automatically for you.\r\n\r\n All packages are signed by Mandriva for security. You can obtain the\r\n GPG public key of the Mandriva Security Team by executing:\r\n\r\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\r\n\r\n You can view other update advisories for Mandriva Linux at:\r\n\r\n http://www.mandriva.com/en/support/security/advisories/\r\n\r\n If you want to report vulnerabilities, please contact\r\n\r\n security_(at)_mandriva.com\r\n _______________________________________________________________________\r\n\r\n Type Bits/KeyID Date User ID\r\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\r\n <security*mandriva.com>\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.12 (GNU/Linux)\r\n\r\niD8DBQFVR5opmqjQ0CJFipgRAo1VAJ0awhJAVKhakeWCL2C3ENHL4HTsEQCgt8oq\r\n0Cl00DAjrlH2+RTQgujLnDs=\r\n=sX2V\r\n-----END PGP SIGNATURE-----\r\n\r\n", "published": "2015-05-04T00:00:00", "modified": "2015-05-04T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31955", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2012-6687"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:58", "edition": 1, "viewCount": 40, "enchantments": {"score": {"value": 5.7, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2012-6687"]}, {"type": "debian", "idList": ["DEBIAN:DLA-430-1:08181", "DEBIAN:DLA-431-1:1169F"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2012-6687"]}, {"type": "nessus", "idList": ["DEBIAN_DLA-430.NASL", "DEBIAN_DLA-431.NASL", "MANDRIVA_MDVSA-2015-226.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310131248"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:14421"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2012-6687"]}], "rev": 4}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2012-6687"]}, {"type": "debian", "idList": ["DEBIAN:DLA-431-1:1169F"]}, {"type": "nessus", "idList": ["MANDRIVA_MDVSA-2015-226.NASL"]}]}, "exploitation": null, "vulnersScore": 5.7}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646790985}}

{"nessus": [{"lastseen": "2021-08-19T12:42:55", "description": "It was discovered that there was a remote denial of service in libfcgi, a library for implementing the FastCGI web server protocol.\n\nFor Debian 6 Squeeze, this issue has been fixed in libfcgi version 2.4.0-8+deb6u1.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2016-02-26T00:00:00", "type": "nessus", "title": "Debian DLA-430-1 : libfcgi security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-6687"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libfcgi-dev", "p-cpe:/a:debian:debian_linux:libfcgi0ldbl", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DLA-430.NASL", "href": "https://www.tenable.com/plugins/nessus/88971", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-430-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88971);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2012-6687\");\n script_bugtraq_id(74454);\n\n script_name(english:\"Debian DLA-430-1 : libfcgi security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that there was a remote denial of service in\nlibfcgi, a library for implementing the FastCGI web server protocol.\n\nFor Debian 6 Squeeze, this issue has been fixed in libfcgi version\n2.4.0-8+deb6u1.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2016/02/msg00022.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/libfcgi\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Upgrade the affected libfcgi-dev, and libfcgi0ldbl packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfcgi-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfcgi0ldbl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libfcgi-dev\", reference:\"2.4.0-8+deb6u1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libfcgi0ldbl\", reference:\"2.4.0-8+deb6u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:42:43", "description": "It was discovered that there was a remote denial of service in libfcgi-perl, a helper library for implementing the FastCGI web server protocol for Perl.\n\nFor Debian 6 Squeeze, this issue has been fixed in libfcgi-perl version 0.71-1+squeeze1+deb6u1.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2016-02-26T00:00:00", "type": "nessus", "title": "Debian DLA-431-1 : libfcgi-perl security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-6687"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libfcgi-perl", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DLA-431.NASL", "href": "https://www.tenable.com/plugins/nessus/88972", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-431-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(88972);\n script_version(\"2.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2012-6687\");\n script_bugtraq_id(74454);\n\n script_name(english:\"Debian DLA-431-1 : libfcgi-perl security update\");\n script_summary(english:\"Checks dpkg output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that there was a remote denial of service in\nlibfcgi-perl, a helper library for implementing the FastCGI web server\nprotocol for Perl.\n\nFor Debian 6 Squeeze, this issue has been fixed in libfcgi-perl\nversion 0.71-1+squeeze1+deb6u1.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2016/02/msg00023.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/libfcgi-perl\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Upgrade the affected libfcgi-perl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libfcgi-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/02/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/02/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libfcgi-perl\", reference:\"0.71-1+squeeze1+deb6u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:46:18", "description": "Updated fcgi packages fix security vulnerability :\n\nFCGI does not perform range checks for file descriptors before use of the FD_SET macro. This FD_SET macro could allow for more than 1024 total file descriptors to be monitored in the closing state. This may allow remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening many socket connections to the host and crashing the service (CVE-2012-6687).", "cvss3": {"score": null, "vector": null}, "published": "2015-05-05T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : fcgi (MDVSA-2015:226)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-6687"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:fcgi", "p-cpe:/a:mandriva:linux:lib64fcgi0", "p-cpe:/a:mandriva:linux:lib64fcgi0-devel", "cpe:/o:mandriva:business_server:1"], "id": "MANDRIVA_MDVSA-2015-226.NASL", "href": "https://www.tenable.com/plugins/nessus/83250", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2015:226. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(83250);\n script_version(\"2.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2012-6687\");\n script_xref(name:\"MDVSA\", value:\"2015:226\");\n\n script_name(english:\"Mandriva Linux Security Advisory : fcgi (MDVSA-2015:226)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated fcgi packages fix security vulnerability :\n\nFCGI does not perform range checks for file descriptors before use of\nthe FD_SET macro. This FD_SET macro could allow for more than 1024\ntotal file descriptors to be monitored in the closing state. This may\nallow remote attackers to cause a denial of service (stack memory\ncorruption, and infinite loop or daemon crash) by opening many socket\nconnections to the host and crashing the service (CVE-2012-6687).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://advisories.mageia.org/MGASA-2015-0184.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected fcgi, lib64fcgi0 and / or lib64fcgi0-devel\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:fcgi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64fcgi0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64fcgi0-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:business_server:1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/05/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/05/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"fcgi-2.4.0-12.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64fcgi0-2.4.0-12.1.mbs1\")) flag++;\nif (rpm_check(release:\"MDK-MBS1\", cpu:\"x86_64\", reference:\"lib64fcgi0-devel-2.4.0-12.1.mbs1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:00", "description": "Buffer overflow on fd_set structure handling.", "edition": 1, "cvss3": {}, "published": "2015-05-04T00:00:00", "title": "FastCGI buffer overflow", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2012-6687"], "modified": "2015-05-04T00:00:00", "id": "SECURITYVULNS:VULN:14421", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14421", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "debian": [{"lastseen": "2021-10-23T22:15:34", "description": "Package : libfcgi\nVersion : 2.4.0-8+deb6u1\nCVE ID : CVE-2012-6687\nDebian Bug : 681591\n\nIt was discovered that there was a remote denial of service in\nlibfcgi, a library for implementing the FastCGI web server protocol.\n\nFor Debian 6 Squeeze, this issue has been fixed in libfcgi version\n2.4.0-8+deb6u1.\n\n\nRegards,\n\n- -- \n ,&#x27;&#x27;`.\n : :&#x27; : Chris Lamb\n `. `&#x27;` lamby@debian.org / chris-lamb.co.uk\n `-", "cvss3": {}, "published": "2016-02-25T10:23:11", "type": "debian", "title": "[SECURITY] [DLA 430-1] libfcgi security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-6687"], "modified": "2016-02-25T10:23:11", "id": "DEBIAN:DLA-430-1:08181", "href": "https://lists.debian.org/debian-lts-announce/2016/02/msg00022.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-10-23T22:17:03", "description": "Package : libfcgi-perl\nVersion : 0.71-1+squeeze1+deb6u1\nCVE ID : CVE-2012-6687\nDebian Bug : 815840\n\nIt was discovered that there was a remote denial of service in libfcgi-perl,\na helper library for implementing the FastCGI web server protocol for Perl.\n\nFor Debian 6 Squeeze, this issue has been fixed in libfcgi-perl version\n0.71-1+squeeze1+deb6u1.\n\n\nRegards,\n\n- -- \n ,&#x27;&#x27;`.\n : :&#x27; : Chris Lamb\n `. `&#x27;` lamby@debian.org / chris-lamb.co.uk\n `-", "cvss3": {}, "published": "2016-02-25T10:33:50", "type": "debian", "title": "[SECURITY] [DLA 431-1] libfcgi-perl security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-6687"], "modified": "2016-02-25T10:33:50", "id": "DEBIAN:DLA-431-1:1169F", "href": "https://lists.debian.org/debian-lts-announce/2016/02/msg00023.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "debiancve": [{"lastseen": "2021-12-14T17:49:44", "description": "FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.", "cvss3": {}, "published": "2015-02-19T15:59:00", "type": "debiancve", "title": "CVE-2012-6687", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-6687"], "modified": "2015-02-19T15:59:00", "id": "DEBIANCVE:CVE-2012-6687", "href": "https://security-tracker.debian.org/tracker/CVE-2012-6687", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "openvas": [{"lastseen": "2019-05-29T18:35:01", "description": "Mageia Linux Local Security Checks mgasa-2016-0089", "cvss3": {}, "published": "2016-03-03T00:00:00", "type": "openvas", "title": "Mageia Linux Local Check: mgasa-2016-0089", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2012-6687"], "modified": "2019-03-14T00:00:00", "id": "OPENVAS:1361412562310131248", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310131248", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: mgasa-2016-0089.nasl 14180 2019-03-14 12:29:16Z cfischer $\n#\n# Mageia Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2016 Eero Volotinen, http://www.solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.131248\");\n script_version(\"$Revision: 14180 $\");\n script_tag(name:\"creation_date\", value:\"2016-03-03 14:39:18 +0200 (Thu, 03 Mar 2016)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-14 13:29:16 +0100 (Thu, 14 Mar 2019) $\");\n script_name(\"Mageia Linux Local Check: mgasa-2016-0089\");\n script_tag(name:\"insight\", value:\"Updated fcgi packages fix security vulnerability: FCGI does not perform range checks for file descriptors before use of the FD_SET macro. This FD_SET macro could allow for more than 1024 total file descriptors to be monitored in the closing state. This may allow remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening many socket connections to the host and crashing the service (CVE-2012-6687).\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://advisories.mageia.org/MGASA-2016-0089.html\");\n script_cve_id(\"CVE-2012-6687\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mageia_linux\", \"ssh/login/release\", re:\"ssh/login/release=MAGEIA5\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Mageia Linux Local Security Checks mgasa-2016-0089\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Mageia Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MAGEIA5\")\n{\nif ((res = isrpmvuln(pkg:\"perl-FCGI\", rpm:\"perl-FCGI~0.770.0~4.1.mga5\", rls:\"MAGEIA5\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:50:18", "description": "FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a\ndenial of service (segmentation fault and crash) via a large number of\nconnections.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681591>\n * <https://bugs.launchpad.net/ubuntu/+source/libfcgi/+bug/1418778>\n", "cvss3": {}, "published": "2015-02-19T00:00:00", "type": "ubuntucve", "title": "CVE-2012-6687", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-6687"], "modified": "2015-02-19T00:00:00", "id": "UB:CVE-2012-6687", "href": "https://ubuntu.com/security/CVE-2012-6687", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "mageia": [{"lastseen": "2022-04-18T11:19:34", "description": "Updated fcgi packages fix security vulnerability: FCGI does not perform range checks for file descriptors before use of the FD_SET macro. This FD_SET macro could allow for more than 1024 total file descriptors to be monitored in the closing state. This may allow remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening many socket connections to the host and crashing the service (CVE-2012-6687). \n", "cvss3": {}, "published": "2016-03-02T18:28:46", "type": "mageia", "title": "Updated perl-FCGI packages fix CVE-2012-6687\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-6687"], "modified": "2016-03-02T18:28:46", "id": "MGASA-2016-0089", "href": "https://advisories.mageia.org/MGASA-2016-0089.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-04-18T11:19:34", "description": "Updated fcgi packages fix security vulnerability: FCGI does not perform range checks for file descriptors before use of the FD_SET macro. This FD_SET macro could allow for more than 1024 total file descriptors to be monitored in the closing state. This may allow remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening many socket connections to the host and crashing the service (CVE-2012-6687). \n", "cvss3": {}, "published": "2015-05-03T00:19:16", "type": "mageia", "title": "Updated fcgi packages fix CVE-2012-6687\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-6687"], "modified": "2015-05-03T00:19:16", "id": "MGASA-2015-0184", "href": "https://advisories.mageia.org/MGASA-2015-0184.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "cve": [{"lastseen": "2022-03-23T13:56:16", "description": "FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.", "cvss3": {}, "published": "2015-02-19T15:59:00", "type": "cve", "title": "CVE-2012-6687", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2012-6687"], "modified": "2017-09-08T01:29:00", "cpe": ["cpe:/a:fastcgi:fcgi:2.4.0"], "id": "CVE-2012-6687", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6687", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:fastcgi:fcgi:2.4.0:*:*:*:*:*:*:*"]}]}