PT-2001-2495 · Apache · Mod Auth Pgsql Sys+1

Publicado 2001-08-29 · Atualizado 2017-07-11 · CVE-2001-1379

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod auth pgsql version 0.9.5 mod auth pgsql sys version 0.9.4

Description The issue allows remote attackers to bypass authentication and execute arbitrary SQL via a SQL injection attack on the user name. This can lead to unauthorized access and potential data manipulation.

Recommendations For mod auth pgsql version 0.9.5, update to a version that fixes the SQL injection issue. For mod auth pgsql sys version 0.9.4, update to a version that fixes the SQL injection issue. As a temporary workaround, consider restricting access to the authentication module to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2001-1379

Produtos afetados

Mod Auth Pgsql

Mod Auth Pgsql Sys

Referências · 10

• http://rhn.redhat.com/errata/RHSA-2001-124.html · Aviso do Fabricante
• http://securityfocus.com/bid/3251 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0040.html · Nota
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:03.mod_auth_pgsql.asc · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7059 · Nota
• http://marc.info/?l=bugtraq&m=99911895901812&w=2 · Nota
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000427 · Aviso do Fabricante
• http://securityfocus.com/bid/3253 · Nota
• http://iss.net/security_center/static/7054.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1379 · Nota de Segurança