Security World: [SECURITY] [DSA 1688-1] New courier-authlib packages fix SQL injection

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1688 security@debian.org
http://www.debian.org/security/ Steffen Joeris
December 20, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : courier-authlib
Vulnerability : SQL injection
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2008-2380 CVE-2008-2667

Two SQL injection vulnerabilities have beein found in courier-authlib,
the courier authentification library. The MySQL database interface used
insufficient escaping mechanisms when constructing SQL statements,
leading to SQL injection vulnerabilities if certain charsets are used
(CVE-2008-2380). A similar issue affects the PostgreSQL database
interface (CVE-2008-2667).

For the stable distribution (etch), these problems have been fixed in
version 0.58-4+etch2.

For the testing distribution (lenny) and the unstable distribution
(sid), these problems have been fixed in version 0.61.0-1+lenny1.

We recommend that you upgrade your courier-authlib packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58.orig.tar.gz
Size/MD5 checksum: 3342115 75b5b2b72d550048ed1b29e687a1a60d
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch2.diff.gz
Size/MD5 checksum: 44232 5345604d34a363e4519077032a9aeb1f
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch2.dsc
Size/MD5 checksum: 970 9652de3cb3cd60fa91aee7cb1e0b8dca

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authdaemon_0.58-4+etch2_arm.deb
Size/MD5 checksum: 6872 27f8dfabf8939a063a2725053d138b03
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-dev_0.58-4+etch2_arm.deb
Size/MD5 checksum: 97966 eba6aa3b836e90a1ff85ce72c97856e1
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-postgresql_0.58-4+etch2_arm.deb
Size/MD5 checksum: 18618 1446523e8fc2028b61c82874b9ddbfe9
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-userdb_0.58-4+etch2_arm.deb
Size/MD5 checksum: 32644 5d4032a7948d90f9873eb256a35c473f
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-ldap_0.58-4+etch2_arm.deb
Size/MD5 checksum: 20928 81b0bf0c3bb6a012178ea76be1412c0b
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-pipe_0.58-4+etch2_arm.deb
Size/MD5 checksum: 7694 adfb37f7da5e86a051942defa5baeffb
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch2_arm.deb
Size/MD5 checksum: 76054 31a727fe1fab3eef91954104ce9a5b40
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-mysql_0.58-4+etch2_arm.deb
Size/MD5 checksum: 18700 2f0f1c6e62d65e1faedbc1f7229f8692

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 81626 a98cb782eb9ac71dbc7cdc148190d4e8
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-postgresql_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 19402 0a22244477b87b572cb864ecb6de5e04
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-ldap_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 21936 8be79200e34bc0772bc11bf440ef8155
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-userdb_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 35924 660a86bbc151ac2326641f0c12d3ba2b
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authdaemon_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 6876 39554139fc894f21349284780882ad4e
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-dev_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 120836 c863a7ee2e9a024d017dc87f1384def5
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-pipe_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 8124 3ebee4b6e23b4eb939c03f52d822dea7
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-mysql_0.58-4+etch2_mipsel.deb
Size/MD5 checksum: 19396 96746e0f3577918cfbbb3118d78f6424

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-pipe_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 8244 54f6e43f51140bf09f871658da742d4f
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-userdb_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 35682 175f7cee84457c57dce1bd3915f9b48b
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 88018 de4c18fbeb549d43de7189023a887b09
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authdaemon_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 6880 4ae52c04c9446d42b39a2340ed2e9ae7
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-ldap_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 21996 54f45485b1f88781ee145dcd6847afc3
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-mysql_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 19746 ba53ebc588b12d139e175e6a3b0e2315
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-postgresql_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 19596 aece91a5ad82c97d0f6f0b0c75a1e628
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-dev_0.58-4+etch2_powerpc.deb
Size/MD5 checksum: 110260 a7f3e9b62fa4dab338af7464562e7f29

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJTQzXAAoJEL97/wQC1SS+ZowH/3qn5mXCDhGve59HqtxW3ngu
M6ylx6jfaL9u8H45+UpTKi+GPB/WCaoJxpZjAdK3xIjpOKR1bSzfnxI0YtDsNsaR
/0nbgWgg3bi6iVNyB5M84mF/BxqOdKrXcNvG/iwXwG+v0v8A8bZ/KeLBD6U14Pkl
79N8/f2INwF1OvnOMWqRDjcYAj65sV9Ez8M8SMZDxQvfK2VNIEItw22th7HAbZ0K
L0sGmrGvVa6KQJ5cuUCZW30jfBS52Jn3GLV7ws1oGlZyMefb1rJslfDKewvpv5IM
3JLj9F6RLluer5eVoUhf8SVM0fgiH3Py0pk5LRN4M5JSSIW5OeW1VD7FZgSZG4c=
=u7OX
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Saturday, December 20, 2008

[SECURITY] [DSA 1688-1] New courier-authlib packages fix SQL injection

No comments:

Post a Comment