ID CVE-2005-3656
Summary Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username. This vulnerability affects mod_auth_pgsql for Apache2, most likely in all Linux and UNIX environments. This vulnerability affects all versions of mod_auth_pgsql before 2.0.3
References
Vulnerable Configurations
  • cpe:2.3:a:guiseppe_tanzilli_and_matthias_eckermann:mod_auth_pgsql:0.9.5:*:*:*:*:*:*:*
    cpe:2.3:a:guiseppe_tanzilli_and_matthias_eckermann:mod_auth_pgsql:0.9.5:*:*:*:*:*:*:*
  • cpe:2.3:a:guiseppe_tanzilli_and_matthias_eckermann:mod_auth_pgsql:0.9.6:*:*:*:*:*:*:*
    cpe:2.3:a:guiseppe_tanzilli_and_matthias_eckermann:mod_auth_pgsql:0.9.6:*:*:*:*:*:*:*
  • cpe:2.3:a:guiseppe_tanzilli_and_matthias_eckermann:mod_auth_pgsql:*:*:*:*:*:*:*:*
    cpe:2.3:a:guiseppe_tanzilli_and_matthias_eckermann:mod_auth_pgsql:*:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 03-10-2018 - 21:33)
Impact:
Exploitability:
CWE CWE-134
CAPEC
  • String Format Overflow in syslog()
    This attack targets the format string vulnerabilities in the syslog() function. An attacker would typically inject malicious input in the format string parameter of the syslog function. This is a common problem, and many public vulnerabilities and associated exploits have been posted.
  • Format String Injection
    An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
oval via4
accepted 2013-04-29T04:07:00.009-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.
family unix
id oval:org.mitre.oval:def:10600
status accepted
submitted 2010-07-09T03:56:16-04:00
title Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.
version 28
redhat via4
advisories
bugzilla
id 1617835
title CVE-2005-3656 security flaw
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • comment mod_auth_pgsql is earlier than 0:2.0.1-7.1
      oval oval:com.redhat.rhsa:tst:20060164001
    • comment mod_auth_pgsql is signed with Red Hat master key
      oval oval:com.redhat.rhsa:tst:20060164002
rhsa
id RHSA-2006:0164
released 2006-01-06
severity Critical
title RHSA-2006:0164: mod_auth_pgsql security update (Critical)
rpms
  • mod_auth_pgsql-0:2.0.1-4.ent.1
  • mod_auth_pgsql-0:2.0.1-7.1
  • mod_auth_pgsql-debuginfo-0:2.0.1-4.ent.1
  • mod_auth_pgsql-debuginfo-0:2.0.1-7.1
refmap via4
bid 16153
confirm
debian DSA-935
gentoo GLSA-200601-05
idefense 20060109 Multiple Vendor mod_auth_pgsql Format String Vulnerability
mandriva MDKSA-2006:009
sectrack 1015446
secunia
  • 18304
  • 18321
  • 18347
  • 18348
  • 18350
  • 18397
  • 18403
  • 18463
  • 18517
sgi 20060101-01-U
trustix 2006-0002
ubuntu USN-239-1
vupen ADV-2006-0070
Last major update 03-10-2018 - 21:33
Published 31-12-2005 - 05:00
Last modified 03-10-2018 - 21:33
Back to Top