CVE:CVE-2010-2253
CNNVD:CNNVD-201007-042
Libwww 是一个高度模组化用户端的网页存取API ，用C语言写成，可在 Unix 和 Windows 上运行。
在libwww-perl 5.835之前的版本中的lwp-download不能拒绝以 .(点)字符开头文件名的下载，远程服务器可以借助(1)3xx重定向到含有伪造文件名的URL或者(2)类似伪造文件名一样的Content-Disposition头来创建或者覆盖文件，并且可能由于将此写入主目录dotfile中而执行任意代码。
solution:Upgrade gisle_aas libwww-perl to a higher version than 0.01,0.02,0.03,0.04,5.00,5.01,5.02,5.03,5.04,5.05,5.06,5.07,5.08,5.09,5.10,5.11,5.12,5.13,5.14,5.15,5.16,5.17,5.18,5.18_03,5.18_04,5.18_05,5.19,5.20,5.21,5.22,5.30,5.31,5.32,5.33,5.34,5.35,5.36,5.41,5.42,5.43,5.44,5.45,5.46,5.47,5.48,5.49,5.50,5.51,5.52,5.53,5.53_90,5.53_91,5.53_92,5.53_93,5.53_94,5.53_95,5.53_96,5.53_97,5.60,5.61,5.62,5.63,5.64,5.65,5.66,5.67,5.68,5.69,5.70,5.71,5.72,5.73,5.74,5.75,5.76,5.77,5.78,5.79,5.800,5.801,5.802,5.803,5.804,5.805,5.806,5.807,5.808,5.810,5.811,5.812,5.813,5.814,5.815,5.816,5.817,5.818,5.819,5.820,5.821,5.822,5.823,5.824,5.825,5.826,5.827,5.828,5.829,5.830,5.831,5.832,5.833,5b5,5b6,5b7,5b8,5b9,5b10,5b11,5b12,5b13,and avoid the version 0.01,0.02,0.03,0.04,5.00,5.01,5.02,5.03,5.04,5.05,5.06,5.07,5.08,5.09,5.10,5.11,5.12,5.13,5.14,5.15,5.16,5.17,5.18,5.18_03,5.18_04,5.18_05,5.19,5.20,5.21,5.22,5.30,5.31,5.32,5.33,5.34,5.35,5.36,5.41,5.42,5.43,5.44,5.45,5.46,5.47,5.48,5.49,5.50,5.51,5.52,5.53,5.53_90,5.53_91,5.53_92,5.53_93,5.53_94,5.53_95,5.53_96,5.53_97,5.60,5.61,5.62,5.63,5.64,5.65,5.66,5.67,5.68,5.69,5.70,5.71,5.72,5.73,5.74,5.75,5.76,5.77,5.78,5.79,5.800,5.801,5.802,5.803,5.804,5.805,5.806,5.807,5.808,5.810,5.811,5.812,5.813,5.814,5.815,5.816,5.817,5.818,5.819,5.820,5.821,5.822,5.823,5.824,5.825,5.826,5.827,5.828,5.829,5.830,5.831,5.832,5.833,5b5,5b6,5b7,5b8,5b9,5b10,5b11,5b12,5b13; Upgrade search.cpan libwww-perl to a higher version than 5.834,5.40_01,and avoid the version (,5.834],5.40_01