Vulnerability Description
Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Guiseppe Tanzilli And Matthias Eckermann | Mod Auth Pgsql | <= 2.0.3 |
Related Weaknesses (CWE)
References
- ftp://patches.sgi.com/support/free/security/advisories/20060101-01-UPatch
- http://secunia.com/advisories/18304PatchVendor Advisory
- http://secunia.com/advisories/18321PatchVendor Advisory
- http://secunia.com/advisories/18347PatchVendor Advisory
- http://secunia.com/advisories/18348PatchVendor Advisory
- http://secunia.com/advisories/18350PatchVendor Advisory
- http://secunia.com/advisories/18397PatchVendor Advisory
- http://secunia.com/advisories/18403PatchVendor Advisory
- http://secunia.com/advisories/18463PatchVendor Advisory
- http://secunia.com/advisories/18517PatchVendor Advisory
- http://securitytracker.com/id?1015446Patch
- http://www.debian.de/security/2006/dsa-935PatchVendor Advisory
- http://www.gentoo.org/security/en/glsa/glsa-200601-05.xmlPatchVendor Advisory
- http://www.giuseppetanzilli.it/mod_auth_pgsql2/
- http://www.idefense.com/intelligence/vulnerabilities/display.php?id=367PatchVendor Advisory
FAQ
What is CVE-2005-3656?
CVE-2005-3656 is a vulnerability with a CVSS score of 10.0 (HIGH). Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to ...
How severe is CVE-2005-3656?
CVE-2005-3656 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-3656?
Check the references section above for vendor advisories and patch information. Affected products include: Guiseppe Tanzilli And Matthias Eckermann Mod Auth Pgsql.