CVE-2005-1824

2005-06-0204:00:00

Debian Security Bug Tracker

security-tracker.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

54.2%

JSON

The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "" (backslash) character, which is used as an escape character and makes the module vulnerable to SQL injection attacks.

OSVersionArchitecturePackageVersionFilename
Debian12allmailutils< 1:0.6.1-2mailutils_1:0.6.1-2_all.deb
Debian11allmailutils< 1:0.6.1-2mailutils_1:0.6.1-2_all.deb
Debian10allmailutils< 1:0.6.1-2mailutils_1:0.6.1-2_all.deb
Debian999allmailutils< 1:0.6.1-2mailutils_1:0.6.1-2_all.deb
Debian13allmailutils< 1:0.6.1-2mailutils_1:0.6.1-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mailutils	< 1:0.6.1-2	mailutils_1:0.6.1-2_all.deb
Debian	11	all	mailutils	< 1:0.6.1-2	mailutils_1:0.6.1-2_all.deb
Debian	10	all	mailutils	< 1:0.6.1-2	mailutils_1:0.6.1-2_all.deb
Debian	999	all	mailutils	< 1:0.6.1-2	mailutils_1:0.6.1-2_all.deb
Debian	13	all	mailutils	< 1:0.6.1-2	mailutils_1:0.6.1-2_all.deb