Sux Services SQL Injection Vulnerability

Bugtraq ID:	7034
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 28 2003 12:00AM
Updated:	Feb 28 2003 12:00AM
Credit:	This issue was announced by the vendor.
Vulnerable:	Sux Services Sux Services 0.2.4 Sux Services Sux Services 0.2.3 Sux Services Sux Services 0.2.2 Sux Services Sux Services 0.2.1 Sux Services Sux Services 0.2
Not Vulnerable:	Sux Services Sux Services 0.2.5

Sux Services SQL Injection Vulnerability

Sux Services is prone to SQL injection attacks. In some cases, data supplied by IRC clients may not be adequately sanitized before being included in queries to the underlying database. This issue was due to an insecure implementation of a printf() related function which was used to print queries to the database.

Exploitation may allow for modification of SQL queries, resulting in information disclosure, database corruption or other attacks.

Sux Services SQL Injection Vulnerability

There is no exploit required.

Sux Services SQL Injection Vulnerability

Solution:
The vendor has addressed this issue in Sux Services 0.2.5.


Sux Services Sux Services 0.2

• Sux Services suxserv-0.2.5.tar.gz
  http://prdownloads.sourceforge.net/suxserv/suxserv-0.2.5.tar.gz?downlo ad

Sux Services Sux Services 0.2.1

• Sux Services suxserv-0.2.5.tar.gz
  http://prdownloads.sourceforge.net/suxserv/suxserv-0.2.5.tar.gz?downlo ad

Sux Services Sux Services 0.2.2

• Sux Services suxserv-0.2.5.tar.gz
  http://prdownloads.sourceforge.net/suxserv/suxserv-0.2.5.tar.gz?downlo ad

Sux Services Sux Services 0.2.3

• Sux Services suxserv-0.2.5.tar.gz
  http://prdownloads.sourceforge.net/suxserv/suxserv-0.2.5.tar.gz?downlo ad

Sux Services Sux Services 0.2.4

• Sux Services suxserv-0.2.5.tar.gz
  http://prdownloads.sourceforge.net/suxserv/suxserv-0.2.5.tar.gz?downlo ad

Sux Services SQL Injection Vulnerability

References:

• Sux Services Homepage (Sux Services)