PT-2005-4413 · Postgresql+1 · Mod Auth Pgsql+1
Publicado
2005-12-31
·
Atualizado
2018-10-03
·
CVE-2005-3656
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
mod auth pgsql versions prior to 2.0.3
Description
The issue concerns multiple format string vulnerabilities in logging functions. These vulnerabilities can be exploited by remote unauthenticated attackers to execute arbitrary code when mod auth pgsql is used for user authentication against a PostgreSQL database. This can be achieved by manipulating the
username variable.Recommendations
For versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the logging functions until a patch is available. Avoid using user-supplied input for the
username variable in the affected logging functions until the issue is resolved.Correção
Use of Externally-Controlled Format String
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Mod Auth Pgsql