PT-2005-2791 · Gnu · Mailutils

Primoz Bratanic · Published 2005-06-02 · Updated 2008-09-05 · CVE-2005-1824

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mailutils SQL authentication module (affected versions not specified)

Description The issue concerns the sql escape string function in auth/sql.c, which fails to properly quote the "" (backslash) character. This character is used as an escape character, making the module susceptible to SQL injection attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-1824

Affected Products

Mailutils

References · 6

• https://security-tracker.debian.org/tracker/CVE-2005-1824 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200506-02.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-1824 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308031 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-1824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1824 · Security Note