Debian: teapop SQL injection vulnerability

    Date10 Jul 2003
    CategoryDebian
    2323
    Posted ByLinuxSecurity Advisories
    The SQL modules do not properlyescape user-supplied strings before using them in SQL queries.
    
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 347-1                     This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                             Matt Zimmerman
    July 8th, 2003                           http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : teapop
    Vulnerability  : SQL injection
    Problem-Type   : remote
    Debian-specific: no
    CVE Ids        : CAN-2003-0515
    
    teapop, a POP-3 server, includes modules for authenticating users
    against a PostgreSQL or MySQL database.  These modules do not properly
    escape user-supplied strings before using them in SQL queries.  This
    vulnerability could be exploited to execute arbitrary SQL under the
    privileges of the database user as which teapop has authenticated.
    
    For the stable distribution (woody) this problem has been fixed in
    version 0.3.4-1woody2.
    
    For the unstable distribution (sid) this problem has been fixed in
    version 0.3.5-2.
    
    We recommend that you update your teapop package.
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    Debian GNU/Linux 3.0 alias woody
    - --------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2.dsc
          Size/MD5 checksum:      642 fed7be378523f17820caf954ae0e2d8b
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2.diff.gz
          Size/MD5 checksum:    89396 918ff202c7fe4dfa8ca74cf7b8ee737d
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4.orig.tar.gz
          Size/MD5 checksum:   139108 af3cfad2323764ee87979c1ed36f1a29
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_alpha.deb
          Size/MD5 checksum:    65630 0ff29aa8b27deeee90da861d42914e8d
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_alpha.deb
          Size/MD5 checksum:    68136 34703e180ad5e59ab368fd33974249a1
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_alpha.deb
          Size/MD5 checksum:    67566 47db645212b9104fdd7d0acf5d2a4eec
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_arm.deb
          Size/MD5 checksum:    56364 e45dea49a7274c38c321780195e8277a
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_arm.deb
          Size/MD5 checksum:    58310 018adfc8b90c1eab8f3312b3e84a1647
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_arm.deb
          Size/MD5 checksum:    57812 78385a963ac081814c4c610d08572b42
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_i386.deb
          Size/MD5 checksum:    55804 05414d63c4b995e026a07a0f9e910a18
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_i386.deb
          Size/MD5 checksum:    57644 9a798c8eea5319c525e65929394f1701
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_i386.deb
          Size/MD5 checksum:    57230 809033cacc20039e32daf4b42d220c0b
    
      Intel IA-64 architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_ia64.deb
          Size/MD5 checksum:    69916 e1a85ad9143b707ea3f200fd3e6adc0b
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_ia64.deb
          Size/MD5 checksum:    72612 150668180e6fca83e78ef0552fb0dd24
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_ia64.deb
          Size/MD5 checksum:    72042 e7faa07d5af324408cf8bf105b31840b
    
      HP Precision architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_hppa.deb
          Size/MD5 checksum:    58700 c6ac59093cd3591aa8251184a09358c1
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_hppa.deb
          Size/MD5 checksum:    60562 74454128967adecd6f2e5f721d37030d
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_hppa.deb
          Size/MD5 checksum:    60078 d4805ec7278e728a82c5da39e5593b5e
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_m68k.deb
          Size/MD5 checksum:    54558 d5c3fc23f82403509739599ffdf6c778
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_m68k.deb
          Size/MD5 checksum:    56218 f848d0a4d168f9d71a2c20723f764d9c
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_m68k.deb
          Size/MD5 checksum:    55862 6ed69fa88c8347e4ca0b67f3224b0e13
    
      Big endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_mips.deb
          Size/MD5 checksum:    59138 764acbee22966dfa0c1694759b9c0e35
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_mips.deb
          Size/MD5 checksum:    61128 cf19e15baa43506e0f3a8dc4d6f3d857
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_mips.deb
          Size/MD5 checksum:    60478 f3e2af096b950dd341a98020b6ebeb81
    
      Little endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_mipsel.deb
          Size/MD5 checksum:    59086 e09f4618622e02b3d533ebddb78c6ad8
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_mipsel.deb
          Size/MD5 checksum:    61082 9aa5fd0a7209ebb212ab083cf68e71c6
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_mipsel.deb
          Size/MD5 checksum:    60468 eea4b43810ce3e5fec1a78b927231f8e
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_powerpc.deb
          Size/MD5 checksum:    57756 0c76c1a5ce0f8001d7d681fa1e5e7543
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_powerpc.deb
          Size/MD5 checksum:    59656 f28a95fae924bb6e3d265c572c21e515
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_powerpc.deb
          Size/MD5 checksum:    59244 0f6e1aac13b84649ae9dde6f874beac5
    
      IBM S/390 architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_s390.deb
          Size/MD5 checksum:    56618 b6f512cc26c3323937a8ebb4affd2b27
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_s390.deb
          Size/MD5 checksum:    58318 626f6878672bc0526c1e6c16c6185158
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_s390.deb
          Size/MD5 checksum:    57908 d605dfaacb83ad92cf0f63297afa2ada
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/t/teapop/teapop_0.3.4-1woody2_sparc.deb
          Size/MD5 checksum:    59376 8d82b3e990a6a1fe6454a922b5235d40
         http://security.debian.org/pool/updates/main/t/teapop/teapop-mysql_0.3.4-1woody2_sparc.deb
          Size/MD5 checksum:    60694 4f0fea369173e6bb12694b3cd34a1128
         http://security.debian.org/pool/updates/main/t/teapop/teapop-pgsql_0.3.4-1woody2_sparc.deb
          Size/MD5 checksum:    57778 bfddf178490d83f4706b8bc2c94fe4ee
    
      These files will probably be moved into the stable distribution on
      its next revision.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.