Zoph Unspecified SQL Injection Vulnerability

Bugtraq ID:	16347
Class:	Input Validation Error
CVE:	CVE-2006-0402
Remote:	Yes
Local:	No
Published:	Jan 23 2006 12:00AM
Updated:	Jul 05 2006 11:14PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Zoph Zoph 0.3.3 Zoph Zoph 0.4 pre2 Zoph Zoph 0.4 Zoph Zoph 0.3 Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:	Zoph Zoph 0.5 pre1

Zoph Unspecified SQL Injection Vulnerability

Zoph is prone to an unspecified SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Zoph Unspecified SQL Injection Vulnerability

An exploit is not required.

Zoph Unspecified SQL Injection Vulnerability

Solution:
The vendor has released an update to address this issue. Please see the referenced advisories for more information and fixes.


Zoph Zoph 0.4 pre2

• Zoph zoph-0.5pre1.tar.gz
  http://prdownloads.sourceforge.net/zoph/zoph-0.5pre1.tar.gz

Zoph Zoph 0.4

• Zoph zoph-0.5pre1.tar.gz
  http://prdownloads.sourceforge.net/zoph/zoph-0.5pre1.tar.gz

Zoph Zoph 0.3.3

• Debian zoph_0.3.3-12sarge1_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/z/zoph/zoph_0.3.3-12sarge 1_all.deb

Zoph Unspecified SQL Injection Vulnerability

References:

• Zoph Changelog (Zoph)
  
• Zoph Homepage (Zoph)