Leon J Breedt Pam-PGSQL Remote SQL Injection Vulnerability
BID:10266
Info
Leon J Breedt Pam-PGSQL Remote SQL Injection Vulnerability
| Bugtraq ID: | 10266 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0366 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 29 2004 12:00AM |
| Updated: | Jul 12 2009 04:07AM |
| Credit: | Primoz Bratanic <[email protected]> discovered this vulnerability. |
| Vulnerable: |
Leon J Breedt pam-pgsql 0.5.2 -7 Leon J Breedt pam-pgsql 0.5.2 Leon J Breedt pam-pgsql 0.5.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 |
| Not Vulnerable: |
Leon J Breedt pam-pgsql 0.5.2 -7.1 Leon J Breedt pam-pgsql 0.5.2 -3woody2 |
Discussion
Leon J Breedt Pam-PGSQL Remote SQL Injection Vulnerability
Leon J Breedt's 'pam-pgsql' is a PAM authentication module to be used with PostgreSQL.
'pam-pgsql' is prone to a vulnerability which will allow SQL queries to be manipulated via any medium which requires a user to authenticate(HTTP, SSH, telnet, etc). Data that is included in SQL query strings is not adequately sanitized.
It may be possible for malicious users to modify the structure of SQL queries.
This issue allows the user to access database resources that would normally be restricted, which may in turn provide an opportunity for the attacker to exploit other vulnerabilities that exist in the server. The attacker may be able to exploit this issue to gain unauthorized access to the host.
Leon J Breedt's 'pam-pgsql' is a PAM authentication module to be used with PostgreSQL.
'pam-pgsql' is prone to a vulnerability which will allow SQL queries to be manipulated via any medium which requires a user to authenticate(HTTP, SSH, telnet, etc). Data that is included in SQL query strings is not adequately sanitized.
It may be possible for malicious users to modify the structure of SQL queries.
This issue allows the user to access database resources that would normally be restricted, which may in turn provide an opportunity for the attacker to exploit other vulnerabilities that exist in the server. The attacker may be able to exploit this issue to gain unauthorized access to the host.
Exploit / POC
Leon J Breedt Pam-PGSQL Remote SQL Injection Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Leon J Breedt Pam-PGSQL Remote SQL Injection Vulnerability
Solution:
Debian has issued fixes.
Leon J Breedt pam-pgsql 0.5.1
Leon J Breedt pam-pgsql 0.5.2
Leon J Breedt pam-pgsql 0.5.2 -7
Debian Linux 3.0 hppa
Debian Linux 3.0 ppc
Debian Linux 3.0 s/390
Debian Linux 3.0
Debian Linux 3.0 arm
Debian Linux 3.0 alpha
Debian Linux 3.0 mips
Debian Linux 3.0 ia-32
Debian Linux 3.0 mipsel
Debian Linux 3.0 sparc
Debian Linux 3.0 m68k
Debian Linux 3.0 ia-64
Solution:
Debian has issued fixes.
Leon J Breedt pam-pgsql 0.5.1
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_hppa.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_hppa.deb -
Debian libpam-pgsql_0.5.2-3woody2_i386.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_i386.deb -
Debian libpam-pgsql_0.5.2-3woody2_ia64.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_ia64.deb -
Debian libpam-pgsql_0.5.2-3woody2_m68k.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_m68k.deb -
Debian libpam-pgsql_0.5.2-3woody2_mips.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mips.deb -
Debian libpam-pgsql_0.5.2-3woody2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mipsel.deb -
Debian libpam-pgsql_0.5.2-3woody2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_powerpc.deb -
Debian libpam-pgsql_0.5.2-3woody2_s390.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_s390.deb -
Debian libpam-pgsql_0.5.2-3woody2_sparc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_sparc.deb
Leon J Breedt pam-pgsql 0.5.2
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_hppa.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_hppa.deb -
Debian libpam-pgsql_0.5.2-3woody2_i386.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_i386.deb -
Debian libpam-pgsql_0.5.2-3woody2_ia64.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_ia64.deb -
Debian libpam-pgsql_0.5.2-3woody2_m68k.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_m68k.deb -
Debian libpam-pgsql_0.5.2-3woody2_mips.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mips.deb -
Debian libpam-pgsql_0.5.2-3woody2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mipsel.deb -
Debian libpam-pgsql_0.5.2-3woody2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_powerpc.deb -
Debian libpam-pgsql_0.5.2-3woody2_s390.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_s390.deb -
Debian libpam-pgsql_0.5.2-3woody2_sparc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_sparc.deb
Leon J Breedt pam-pgsql 0.5.2 -7
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_hppa.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_hppa.deb -
Debian libpam-pgsql_0.5.2-3woody2_i386.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_i386.deb -
Debian libpam-pgsql_0.5.2-3woody2_ia64.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_ia64.deb -
Debian libpam-pgsql_0.5.2-3woody2_m68k.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_m68k.deb -
Debian libpam-pgsql_0.5.2-3woody2_mips.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mips.deb -
Debian libpam-pgsql_0.5.2-3woody2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mipsel.deb -
Debian libpam-pgsql_0.5.2-3woody2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_powerpc.deb -
Debian libpam-pgsql_0.5.2-3woody2_s390.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_s390.deb -
Debian libpam-pgsql_0.5.2-3woody2_sparc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_sparc.deb
Debian Linux 3.0 hppa
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_hppa.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_hppa.deb
Debian Linux 3.0 ppc
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_powerpc.deb
Debian Linux 3.0 s/390
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_s390.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_s390.deb
Debian Linux 3.0
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_hppa.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_hppa.deb -
Debian libpam-pgsql_0.5.2-3woody2_i386.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_i386.deb -
Debian libpam-pgsql_0.5.2-3woody2_ia64.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_ia64.deb -
Debian libpam-pgsql_0.5.2-3woody2_m68k.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_m68k.deb -
Debian libpam-pgsql_0.5.2-3woody2_mips.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mips.deb -
Debian libpam-pgsql_0.5.2-3woody2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mipsel.deb -
Debian libpam-pgsql_0.5.2-3woody2_powerpc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_powerpc.deb -
Debian libpam-pgsql_0.5.2-3woody2_s390.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_s390.deb -
Debian libpam-pgsql_0.5.2-3woody2_sparc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_sparc.deb
Debian Linux 3.0 arm
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb
Debian Linux 3.0 alpha
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb
Debian Linux 3.0 mips
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_mips.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mips.deb
Debian Linux 3.0 ia-32
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_i386.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_i386.deb
Debian Linux 3.0 mipsel
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_mipsel.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_mipsel.deb
Debian Linux 3.0 sparc
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_sparc.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_sparc.deb
Debian Linux 3.0 m68k
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_m68k.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_m68k.deb
Debian Linux 3.0 ia-64
-
Debian libpam-pgsql_0.5.2-3woody2_alpha.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_alpha.deb -
Debian libpam-pgsql_0.5.2-3woody2_arm.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_arm.deb -
Debian libpam-pgsql_0.5.2-3woody2_ia64.deb
http://security.debian.org/pool/updates/main/p/pam-pgsql/libpam-pgsql_ 0.5.2-3woody2_ia64.deb
References
Leon J Breedt Pam-PGSQL Remote SQL Injection Vulnerability
References:
References:
- Debian Bug report logs - #230875 (Debian)