CVE-2005-1824

Currently unrated

Key Information:

Vendor
Gnu
Status
Mailutils
Vendor
CVE Published:
2 June 2005

Summary

The sql_escape_string function in auth/sql.c for the mailutils SQL authentication module does not properly quote the "" (backslash) character, which is used as an escape character and makes the module vulnerable to SQL injection attacks.

References

http://www.gentoo.org/security/en/glsa/glsa-200506-02.xml
vendor-advisoryx_refsource_GENTOO
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=308031
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.