Debian DSA-469-1 : pam-pgsql - missing input sanitising

Primoz Bratanic discovered a bug in libpam-pgsql, a PAM module to authenticate using a PostgreSQL database. The library does not escape all user-supplied data that are sent to the database. An attacker could exploit this bug to insert SQL statements. %NASLMINLEVEL 70300 C Tenable Network Security...

CVE-2004-0366

SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements...

CVE-2004-0366

Removed by vendor...

CVE-2004-0366

CVE-2004-0366 affects libpam-pgsql (pam-pgsql) with a SQL injection vulnerability present in versions prior to 0.5.2. The underlying issue is missing input sanitising that allows an attacker to insert arbitrary SQL statements when data is sent to PostgreSQL. Debian and OpenVAS entries document th...

CVE-2004-0366

SQL injection vulnerability in the libpam-pgsql library before 0.5.2 allows attackers to execute arbitrary SQL statements...

PT-2004-1520 · Unknown · Libpam-Pgsql

Name of the Vulnerable Software and Affected Versions: libpam-pgsql versions prior to 0.5.2 Description: The issue allows attackers to execute arbitrary SQL statements due to a SQL injection vulnerability in the libpam-pgsql library. Recommendations: For versions prior to 0.5.2, update to version...

[SECURITY] [DSA 469-1] New libpam-pgsql packages fix SQL injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 469-1 [email protected] http://www.debian.org/security/ Martin Schulze March 29th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 469-1] New libpam-pgsql packages fix SQL injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 469-1 [email protected] http://www.debian.org/security/ Martin Schulze March 29th, 2004 http://www.debian.org/security/faq -...

DSA-469 pam-pgsql - missing input sanitising

Bulletin has no description...

CVE-2003-0672

Format string vulnerability in pam-pgsql 0.5.2 and earlier allows remote attackers to execute arbitrary code via the username that isp rovided during authentication, which is not properly handled when recording a log message...

CVE-2003-0672

Format string vulnerability in pam-pgsql 0.5.2 and earlier allows remote attackers to execute arbitrary code via the username that isp rovided during authentication, which is not properly handled when recording a log message...

CVE-2003-0672

CVE-2003-0672 describes a format-string vulnerability in pam-pgsql 0.5.2 and earlier, where the username supplied during authentication is treated as a format string when writing logs. This can allow remote attackers to execute arbitrary code with the privileges of the PAM-authenticating process....

pam-pgsql format string bug

Format string bug in username...

[SECURITY] [DSA-370-1] New pam-pgsql packages fix format string vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 370-1 [email protected] http://www.debian.org/security/ Matt Zimmerman August 8th, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA-370-1] New pam-pgsql packages fix format string vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 370-1 [email protected] http://www.debian.org/security/ Matt Zimmerman August 8th, 2003 http://www.debian.org/security/faq -...

DSA-370 pam-pgsql - format string

Bulletin has no description...

CVE-2001-1369

The CVE-2001-1369 issue affects pam-pgsql prior to 0.5.2. It allows remote attackers to bypass authentication or modify user records by injecting SQL into the user or password fields, thereby executing arbitrary SQL. Root cause is SQL injection in authentication-related input. The provided docume...

CVE-2001-1089

Summary of CVE-2001-1089: The vulnerable component is libnss-pgsql in the nss-pgsql package (version 0.9.0 and earlier). The issue allows remote attackers to execute arbitrary SQL queries by injecting SQL code into an HTTP request, indicating a server-side input handling flaw that can affect conf...

CVE-2001-1089

libnss-pgsql in nss-pgsql 0.9.0 and earlier allows remote attackers to execute arbitrary SQL queries by inserting SQL code into an HTTP request...

FreeBSD-SA-02:14.pam-pgsql

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-02:14 Security Advisory FreeBSD, Inc. Topic: pam-pgsql port authentication bypass Category: ports Module: pam-pgsql Announced: 2002-03-12 Credits: Jacques A. Vidrine Affects...