PT-2001-2495 · Apache · Mod Auth Pgsql Sys+1

Published 2001-08-29 · Updated 2017-07-11 · CVE-2001-1379

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mod auth pgsql version 0.9.5 mod auth pgsql sys version 0.9.4

Description The issue allows remote attackers to bypass authentication and execute arbitrary SQL via a SQL injection attack on the user name. This can lead to unauthorized access and potential data manipulation.

Recommendations For mod auth pgsql version 0.9.5, update to a version that fixes the SQL injection issue. For mod auth pgsql sys version 0.9.4, update to a version that fixes the SQL injection issue. As a temporary workaround, consider restricting access to the authentication module to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2001-1379

Affected Products

Mod Auth Pgsql

Mod Auth Pgsql Sys

References · 10

• http://rhn.redhat.com/errata/RHSA-2001-124.html · Vendor Advisory
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:03.mod_auth_pgsql.asc · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000427 · Vendor Advisory
• http://iss.net/security_center/static/7054.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1379 · Security Note
• http://securityfocus.com/bid/3251 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2001-q3/0040.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7059 · Note
• http://marc.info/?l=bugtraq&m=99911895901812&w=2 · Note
• http://securityfocus.com/bid/3253 · Note