Teapop SQL Injection Vulnerability
BID:8146
Info
Teapop SQL Injection Vulnerability
| Bugtraq ID: | 8146 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0515 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 09 2003 12:00AM |
| Updated: | Jul 11 2009 10:56PM |
| Credit: | This issue was announced in a Debian advisory. |
| Vulnerable: |
teapop teapop 0.3.5 teapop teapop 0.3.4 |
| Not Vulnerable: | |
Discussion
Teapop SQL Injection Vulnerability
teapop is prone to an SQL injection vulnerability. This issue occurs in modules supplied with Teapop that allow authentication via a MySQL or PostgreSQL database. Exploitation could allow for SQL queries to be modified, potentially allowing for unauthorized access, information disclosure or other consequences.
teapop is prone to an SQL injection vulnerability. This issue occurs in modules supplied with Teapop that allow authentication via a MySQL or PostgreSQL database. Exploitation could allow for SQL queries to be modified, potentially allowing for unauthorized access, information disclosure or other consequences.
Exploit / POC
Teapop SQL Injection Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Teapop SQL Injection Vulnerability
Solution:
Debian has released an advisory (DSA 347-1) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
Gentoo has released an advisory (200309-18) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes. The following commands can be carried out to download teapop version 0.3.7:
emerge sync
emerge teapop -p
emerge teapop
emerge clean
teapop teapop 0.3.4
Solution:
Debian has released an advisory (DSA 347-1) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
Gentoo has released an advisory (200309-18) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes. The following commands can be carried out to download teapop version 0.3.7:
emerge sync
emerge teapop -p
emerge teapop
emerge clean
teapop teapop 0.3.4
-
Debian teapop-mysql_0.3.4-1woody2_alpha.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_alpha.deb -
Debian teapop-mysql_0.3.4-1woody2_arm.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_arm.deb -
Debian teapop-mysql_0.3.4-1woody2_hppa.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_hppa.deb -
Debian teapop-mysql_0.3.4-1woody2_i386.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_i386.deb -
Debian teapop-mysql_0.3.4-1woody2_ia64.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_ia64.deb -
Debian teapop-mysql_0.3.4-1woody2_m68k.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_m68k.deb -
Debian teapop-mysql_0.3.4-1woody2_mips.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_mips.deb -
Debian teapop-mysql_0.3.4-1woody2_mipsel.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_mipsel.deb -
Debian teapop-mysql_0.3.4-1woody2_powerpc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_powerpc.deb -
Debian teapop-mysql_0.3.4-1woody2_s390.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_s390.deb -
Debian teapop-mysql_0.3.4-1woody2_sparc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3 .4-1woody2_sparc.deb -
Debian teapop-pgsql_0.3.4-1woody2_alpha.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_alpha.deb -
Debian teapop-pgsql_0.3.4-1woody2_arm.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_arm.deb -
Debian teapop-pgsql_0.3.4-1woody2_hppa.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_hppa.deb -
Debian teapop-pgsql_0.3.4-1woody2_i386.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_i386.deb -
Debian teapop-pgsql_0.3.4-1woody2_ia64.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_ia64.deb -
Debian teapop-pgsql_0.3.4-1woody2_m68k.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_m68k.deb -
Debian teapop-pgsql_0.3.4-1woody2_mips.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_mips.deb -
Debian teapop-pgsql_0.3.4-1woody2_mipsel.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_mipsel.deb -
Debian teapop-pgsql_0.3.4-1woody2_powerpc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_powerpc.deb -
Debian teapop-pgsql_0.3.4-1woody2_s390.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_s390.deb -
Debian teapop-pgsql_0.3.4-1woody2_sparc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3 .4-1woody2_sparc.deb -
Debian teapop_0.3.4-1woody2_alpha.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_alpha.deb -
Debian teapop_0.3.4-1woody2_arm.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_arm.deb -
Debian teapop_0.3.4-1woody2_hppa.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_hppa.deb -
Debian teapop_0.3.4-1woody2_i386.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_i386.deb -
Debian teapop_0.3.4-1woody2_ia64.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_ia64.deb -
Debian teapop_0.3.4-1woody2_m68k.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_m68k.deb -
Debian teapop_0.3.4-1woody2_mips.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_mips.deb -
Debian teapop_0.3.4-1woody2_mipsel.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_mipsel.deb -
Debian teapop_0.3.4-1woody2_powerpc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_powerpc.deb -
Debian teapop_0.3.4-1woody2_s390.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_s390.deb -
Debian teapop_0.3.4-1woody2_sparc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1wo ody2_sparc.deb
References
Teapop SQL Injection Vulnerability
References:
References: