Debian Security Advisory

DSA-1757-1 auth2db -- SQL injection

Date Reported:
30 Mar 2009
Affected Packages:
auth2db
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 521823.
More information:

It was discovered that auth2db, an IDS logger, log viewer and alert generator, is prone to an SQL injection vulnerability, when used with multibyte character encodings.

The oldstable distribution (etch) doesn't contain auth2db.

For the stable distribution (lenny), this problem has been fixed in version 0.2.5-2+dfsg-1+lenny1.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 0.2.5-2+dfsg-1.1.

We recommend that you upgrade your auth2db packages.

Fixed in:

Debian GNU/Linux 5.0 (lenny)

Source:
http://security.debian.org/pool/updates/main/a/auth2db/auth2db_0.2.5-2+dfsg-1+lenny1.dsc
http://security.debian.org/pool/updates/main/a/auth2db/auth2db_0.2.5-2+dfsg.orig.tar.gz
http://security.debian.org/pool/updates/main/a/auth2db/auth2db_0.2.5-2+dfsg-1+lenny1.diff.gz
Architecture-independent component:
http://security.debian.org/pool/updates/main/a/auth2db/auth2db_0.2.5-2+dfsg-1+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/auth2db/auth2db-filters_0.2.5-2+dfsg-1+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/auth2db/auth2db-common_0.2.5-2+dfsg-1+lenny1_all.deb
http://security.debian.org/pool/updates/main/a/auth2db/auth2db-frontend_0.2.5-2+dfsg-1+lenny1_all.deb

MD5 checksums of the listed files are available in the original advisory.