Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Gentoo GLSA 201209-18 Normal: Postfixadmin SQL Injection and XSS

gentoo
Calendar Grey September 27, 2012
Scroller Gentoo
Numerous security flaws identified in Postfixadmin may result in SQL injection and XSS attacks; updating is advised.
Multiple vulnerabilities have been found in Postfixadmin which may lead to SQL injection or cross-site scripting attacks.

Summary

Multiple SQL injection vulnerabilities (CVE-2012-0811) and cross-site scripting vulnerabilities (CVE-2012-0812) have been found in Postfixadmin.

Topics%20covered

Topics Covered

security advisory gentoo sql injection xss normal postfixadmin

Resolution

All Postfixadmin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/postfixadmin-2.3.5"

References

[ 1 ] CVE-2012-0811 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0811 [ 2 ] CVE-2012-0812 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0812

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201209-18
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: Postfixadmin: Multiple vulnerabilities
Date: September 27, 2012
Bugs: #400971
ID: 201209-18

Topics%20covered

Topics Covered

security advisory gentoo sql injection xss normal postfixadmin

Synopsis

Multiple vulnerabilities have been found in Postfixadmin which may lead to SQL injection or cross-site scripting attacks.

Background

Postfixadmin is a web-based management tool for Postfix-style virtual domains and users.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/postfixadmin < 2.3.5 >= 2.3.5

Impact

===== A remote attacker could exploit these vulnerabilities to execute arbitrary SQL statements or arbitrary HTML and script code.

Workaround

There is no known workaround at this time.