oss-security - Re: CVE Request: courier-authlib

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 11 Mar 2009 12:04:21 +1100
From: Steffen Joeris <steffen.joeris@...lelinux.de>
To: oss-security@...ts.openwall.com
Cc: Pierre-Yves Rofes <py@...too.org>
Subject: Re: CVE Request: courier-authlib < 0.62.0 SQL Injection

Hi Pierre-Yves

> From Changelog:
>
> "0.62.0
> 2008-12-17  Sam Varshavchik  <mrsam@...rier-mta.com>
>
> * authpgsqllib.c: Use PQescapeStringConn() instead of removing all
>  apostrophes from query parameters. This fixes a potential SQL injection
>  vulnerability if the Postgres database uses a non-Latin locale."
>
> References:
> http://www.courier-mta.org/authlib/changelog.html
> http://bugs.gentoo.org/show_bug.cgi?id=252576
This should be CVE-2008-2380.


Cheers
Steffen

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.