courier - missing input sanitizing [LWN.net]

Package(s):

courier

CVE #(s):

CAN-2003-0040

Created:

January 30, 2003

Updated:

February 5, 2003

Description:

The developers of courier, an integrated user side mail server, discovered a problem in the PostgreSQL auth module. Not all potentially malicious characters were sanitized before the username was passed to the PostgreSQL engine. An attacker could inject arbitrary SQL commands and queries exploiting this vulnerability. The MySQL auth module is not affected.

Alerts:

Debian

DSA-247-1

2003-01-30

(Log in to post comments)