PT-2005-2791 · Gnu · Mailutils

Primoz Bratanic · Publicado 2005-06-02 · Atualizado 2008-09-05 · CVE-2005-1824

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mailutils SQL authentication module (affected versions not specified)

Description The issue concerns the sql escape string function in auth/sql.c, which fails to properly quote the "" (backslash) character. This character is used as an escape character, making the module susceptible to SQL injection attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-1824

Produtos afetados

Mailutils

Referências · 6

• https://security-tracker.debian.org/tracker/CVE-2005-1824 · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200506-02.xml · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2005-1824 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308031 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-1824 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-1824 · Nota de Segurança