CVE-2008-2380 SQL injection vulnerability in authpgsqllib.c in Courier-Authlib before 0.62.0, when a non-Latin locale Postgres database is used, allows remote attackers to execute arbitrary SQL commands via query p...
MediumCVSS 5.1
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in authpgsqllib.c in Courier-Authlib before 0.62.0, when a non-Latin locale Postgres database is used, allows remote attackers to execute arbitrary SQL commands via query parameters containing apostrophes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| courier-mta courtier-authlib | = 0.52 | No fix listed |
| courier-mta courtier-authlib | = 0.53 | No fix listed |
| courier-mta courtier-authlib | = 0.54 | No fix listed |
| courier-mta courtier-authlib | = 0.55 | No fix listed |
| courier-mta courtier-authlib | = 0.56 | No fix listed |
| courier-mta courtier-authlib | = 0.57 | No fix listed |
| courier-mta courtier-authlib | = 0.58 | No fix listed |
| courier-mta courtier-authlib | = 0.59 | No fix listed |
| courier-mta courtier-authlib | = 0.59.1 | No fix listed |
| courier-mta courtier-authlib | = 0.59.2 | No fix listed |
| courier-mta courtier-authlib | = 0.59.3 | No fix listed |
| courier-mta courtier-authlib | = 0.60 | No fix listed |
| courier-mta courtier-authlib | = 0.60.1 | No fix listed |
| courier-mta courtier-authlib | = 0.60.2 | No fix listed |
| courier-mta courtier-authlib | = 0.60.3 | No fix listed |
| courier-mta courtier-authlib | = 0.60.4 | No fix listed |
| courier-mta courtier-authlib | = 0.60.5 | No fix listed |
| courier-mta courtier-authlib | = 0.60.6 | No fix listed |
| courier-mta courtier-authlib | = 0.61.0 | No fix listed |
| courier-mta courtier-authlib | = 0.61.1 | No fix listed |
| debian/courier-authlib(Debian:12) | < 0.61.0-1+lenny1 | 0.61.0-1+lenny1 |
| debian/courier-authlib(Debian:13) | < 0.61.0-1+lenny1 | 0.61.0-1+lenny1 |
| debian/courier-authlib(Debian:14) | < 0.61.0-1+lenny1 | 0.61.0-1+lenny1 |
References
- 50811 vdb-entry
- 33235 third-party-advisory vendor-advisory
- 34234 third-party-advisory
- GLSA-200903-25 vendor-advisory
- www.courier-mta.org vendor-advisory
- 32926 patch vdb-entry
- courier-library-postgres-sql-injection(47494) vdb-entry
- Debian Security Tracker CVE-2008-2380 vendor-advisory