|
|
>> Fedora Security Update Fixes mod_auth_pgsql Format String Issues
|
Title : Fedora Security Update Fixes mod_auth_pgsql Format String Issues
VUPEN ID : VUPEN/ADV-2006-0085
CVE ID : CVE-2005-3656
Rated as : Critical 
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2006-01-09
|
Fedora has released updated packages to address multiple vulnerabilities identified in mod_auth_pgsql. These flaws are due to format string errors in the logging functionality that does not properly validate certain strings before being passed to syslog, which could be exploited by unauthenticated remote attackers to compromise a vulnerable web server where mod_auth_pgsql is configured to perform user authentication against a PostgreSQL database. For additional information, see : VUPEN/ADV-2006-0070
Affected Products
Fedora Core 3
Fedora Core 4
Solution
Upgrade the affected packages :
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/
f4de3874523d13558b62a7b616a9924b SRPMS/mod_auth_pgsql-2.0.1-6.2.src.rpm
710fe9e31a155fca650aa2e948caf3e0 x86_64/mod_auth_pgsql-2.0.1-6.2.x86_64.rpm
a98acc532d16f6824643f84681a925ba x86_64/debug/mod_auth_pgsql-debuginfo-2.0.1-6.2.x86_64.rpm
2b1130b5b5be47de09f927b2dd87bd94 i386/mod_auth_pgsql-2.0.1-6.2.i386.rpm
2d348cb3ca7f7525dce925a20fed88da i386/debug/mod_auth_pgsql-debuginfo-2.0.1-6.2.i386.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/
d92214578ca55f9fe41d1ae02bf6d43e SRPMS/mod_auth_pgsql-2.0.1-8.1.src.rpm
747cb8b5486624f9df1057fca3ee7e86 ppc/mod_auth_pgsql-2.0.1-8.1.ppc.rpm
7039f4f23f6a28fc27faa06ef83ea3a0 ppc/debug/mod_auth_pgsql-debuginfo-2.0.1-8.1.ppc.rpm
d5815a490b1ec2c2f59f9715253d5665 x86_64/mod_auth_pgsql-2.0.1-8.1.x86_64.rpm
4a1db6971295f3cc99b8641485577123 x86_64/debug/mod_auth_pgsql-debuginfo-2.0.1-8.1.x86_64.rpm
6ce00956921bda6ae3f5f6ed19bdde75 i386/mod_auth_pgsql-2.0.1-8.1.i386.rpm
4b265b8401bc3c5b56140b0bb65ce159 i386/debug/mod_auth_pgsql-debuginfo-2.0.1-8.1.i386.rpm
References
http://www.vupen.com/english/advisories/2006/0085
http://www.frsirt.com/english/reference/4007
http://www.frsirt.com/english/reference/4008
ChangeLog
2006-01-09 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
