oss-security - CVE Request: courier-authlib

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Tue, 10 Mar 2009 23:46:37 +0100
From: Pierre-Yves Rofes <py@...too.org>
To: oss-security@...ts.openwall.com
Subject: CVE Request: courier-authlib < 0.62.0 SQL Injection

Hi,

>From Changelog:

"0.62.0
2008-12-17  Sam Varshavchik  <mrsam@...rier-mta.com>

* authpgsqllib.c: Use PQescapeStringConn() instead of removing all
 apostrophes from query parameters. This fixes a potential SQL injection
 vulnerability if the Postgres database uses a non-Latin locale."

References:
http://www.courier-mta.org/authlib/changelog.html
http://bugs.gentoo.org/show_bug.cgi?id=252576

Thanks,

-- 
Pierre-Yves Rofes
Gentoo Linux Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.