Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.69167
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:1002
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2010:1002.

The mod_auth_mysql package includes an extension module for the Apache HTTP
Server, which can be used to implement web user authentication against a
MySQL database.

A flaw was found in the way mod_auth_mysql escaped certain
multibyte-encoded strings. If mod_auth_mysql was configured to use a
multibyte character set that allowed a backslash (\) as part of the
character encodings, a remote attacker could inject arbitrary SQL commands
into a login request. (CVE-2008-2384)

Note: This flaw only affected non-default installations where
AuthMySQLCharacterSet is configured to use one of the affected multibyte
character sets. Installations that did not use the AuthMySQLCharacterSet
configuration option were not vulnerable to this flaw.

All mod_auth_mysql users are advised to upgrade to this updated package,
which contains a backported patch to correct this issue. After installing
the updated package, the httpd daemon must be restarted for the update to
take effect.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2010-1002.html

Risk factor : High

CVSS Score:
7.5

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2008-2384
BugTraq ID: 33392
http://www.securityfocus.com/bid/33392
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053899.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053903.html
http://openwall.com/lists/oss-security/2009/01/21/10
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10172
http://www.redhat.com/support/errata/RHSA-2009-0259.html
http://www.redhat.com/support/errata/RHSA-2010-1002.html
http://secunia.com/advisories/33627
http://secunia.com/advisories/43302
http://www.vupen.com/english/advisories/2009/0226
http://www.vupen.com/english/advisories/2011/0367
XForce ISS Database: modauthmysql-multibyte-sql-injection(48163)
https://exchange.xforce.ibmcloud.com/vulnerabilities/48163
CopyrightCopyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.