There are some other problems with your code:

#!/usr/bin/perl
    local ($buffer, @pairs, $pair, $name, $value, %FORM);
    # Read in text
    $ENV{'REQUEST_METHOD'} =~ tr/a-z/A-Z/;
    if ($ENV{'REQUEST_METHOD'} eq "POST")
    {
        read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
    }else {
        $buffer = $ENV{'QUERY_STRING'};
    }
    # Split information into name/value pairs
    @pairs = split(/&/, $buffer);
    foreach $pair (@pairs)
    {
        ($name, $value) = split(/=/, $pair);
        $value =~ tr/+/ /;
        $value =~ s/%(..)/pack("C", hex($1))/eg;
        $FORM{$name} = $value;
    }
   my $old_pass = $FORM{oldpass};
   my $new_pass = $FORM{newpass1};
   my $new_pass2 = $FORM{newpass2};

print "Content-type:text/html\r\n\r\n";
use CGI;
[download]

(1) Get rid of all that manual CGI handling. It looks like copied from some Perl 4 script, it can't handle multipart forms, and it is completely redundant. You already loaded CGI, so use it:

use CGI qw( param header );
my $old_pass=param('oldpass');
my $new_pass=param('newpass1');
my $new_pass=param('newpass2');
print header({-type=>'text/html'});
[download]

(2) Choose one indent style, and use it consistently. It costs far too much time to follow the code with this messy indent.

(3) Unless you need to pass the password to some other system, encrypting it is dangerously wrong. Especially if your code contains the encryption key in plain text. The safe approach to handling passwords is to salt (add some random value) and hash them using a strong hash algorithm. Forget MD4 and MD5, they are nearly broken. Use bcrypt and be prepared to change the hashing algorithm in the future. To verify a password, salt it with the stored salt value and hash it, then compare the stored hash value with the freshly calculated hash value.

(4) You allow to change the password using GET requests. This will make both the old and the new password appear in clear text in the web server logs, and in the browser history. Use only POST requests for checking and changing passwords. They can be logged, too, but they aren't by default.

(5) RFC 2616 states that "the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval", i.e. you should actively prevent changing the password using something else than a POST request.

Alexander