SQL injection vulnerability in the Courier Authentication Library (aka courier-authlib) before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are used, allows remote attackers to execute arbitrary SQL commands via the username and unspecified other vectors.

This update of courier-authlib fixes a bug that allowed SQL injections. (CVE-2008-2667)

Two SQL injection vulnerabilities have been found in courier-authlib, the courier authentification library. The MySQL database interface used insufficient escaping mechanisms when constructing SQL statements, leading to SQL injection vulnerabilities if certain charsets are used (CVE-2008-2380 ). A similar issue affects the PostgreSQL database interface (CVE-2008-2667 ).

The remote host is affected by the vulnerability described in GLSA-200809-05 (Courier Authentication Library: SQL injection vulnerability)

    It has been discovered that some input (e.g. the username) passed to     the library are not properly sanitised before being used in SQL     queries.
  Impact :

    A remote attacker could provide specially crafted input to the library,     possibly resulting in the remote execution of arbitrary SQL commands.
    NOTE: Exploitation of this vulnerability requires that a MySQL database     is used for authentication and that a Non-Latin character set is     selected.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
39939	openSUSE Security Update : courier-authlib (courier-authlib-42)	Nessus	SuSE Local Security Checks	medium
35225	Debian DSA-1688-1 : courier-authlib - SQL injection	Nessus	Debian Local Security Checks	medium
34104	GLSA-200809-05 : Courier Authentication Library: SQL injection vulnerability	Nessus	Gentoo Local Security Checks	medium
33223	openSUSE 10 Security Update : courier-authlib (courier-authlib-5352)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2008-2667

critical

Tenable Plugins

medium

medium

medium

medium