CVE-2008-2667 SQL injection vulnerability in the Courier Authentication Library (aka courier-authlib) before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are....
MediumCVSS 5.1
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the Courier Authentication Library (aka courier-authlib) before 0.60.6 on SUSE openSUSE 10.3 and 11.0, and other platforms, when MySQL and a non-Latin character set are used, allows remote attackers to execute arbitrary SQL commands via the username and unspecified other vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| courier-mta courtier-authlib | = 0.52 | No fix listed |
| courier-mta courtier-authlib | = 0.53 | No fix listed |
| courier-mta courtier-authlib | = 0.54 | No fix listed |
| courier-mta courtier-authlib | = 0.55 | No fix listed |
| courier-mta courtier-authlib | = 0.56 | No fix listed |
| courier-mta courtier-authlib | = 0.57 | No fix listed |
| courier-mta courtier-authlib | = 0.58 | No fix listed |
| courier-mta courtier-authlib | = 0.59 | No fix listed |
| courier-mta courtier-authlib | = 0.59.1 | No fix listed |
| courier-mta courtier-authlib | = 0.59.2 | No fix listed |
| courier-mta courtier-authlib | = 0.59.3 | No fix listed |
| courier-mta courtier-authlib | = 0.60 | No fix listed |
| courier-mta courtier-authlib | = 0.60.1 | No fix listed |
| courier-mta courtier-authlib | = 0.60.2 | No fix listed |
| courier-mta courtier-authlib | = 0.60.3 | No fix listed |
| courier-mta courtier-authlib | = 0.60.4 | No fix listed |
| courier-mta courtier-authlib | = 0.60.5 | No fix listed |
| debian/courier-authlib(Debian:12) | < 0.60.1-2.1 | 0.60.1-2.1 |
| debian/courier-authlib(Debian:13) | < 0.60.1-2.1 | 0.60.1-2.1 |
| debian/courier-authlib(Debian:14) | < 0.60.1-2.1 | 0.60.1-2.1 |
References
- bugs.gentoo.org
- SUSE-SR:2008:014 vendor-advisory
- 30591 third-party-advisory vendor-advisory
- 30967 third-party-advisory vendor-advisory
- GLSA-200809-05 vendor-advisory
- www.courier-mta.org
- [courier-users] 20080314 Re: [courier-users] [Fwd: Re: authmysql vs apostrophe] mailing-list
- [courier-announce] 20080608 courier-authlib 0.60.6 released mailing-list
- opensuse-unspecified-sql-injection(43628) vdb-entry
- Debian Security Tracker CVE-2008-2667 vendor-advisory
- bugs.debian.org issue-tracking