CVE-2005-3656

Published: Dec 31, 2005Modified: Apr 16, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.

Affected (3)

Products: Guiseppe Tanzilli And Matthias Eckermann: Mod Auth Pgsql

Guiseppe Tanzilli And Matthias Eckermann

1 product

Mod Auth Pgsql

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Guiseppe Tanzilli And Matthias Eckermann Mod Auth Pgsql	Up to 2.0.3
Guiseppe Tanzilli And Matthias Eckermann Mod Auth Pgsql	Version 0.9.5
Guiseppe Tanzilli And Matthias Eckermann Mod Auth Pgsql	Version 0.9.6

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (48)

ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U (unsafe URL)

Source: cve@mitre.org

Patch

http://secunia.com/advisories/18304

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18321

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18347

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18348

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18350

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18397

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18403

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18463

Source: cve@mitre.org

PatchVendor Advisory

http://secunia.com/advisories/18517

Source: cve@mitre.org

PatchVendor Advisory

http://securitytracker.com/id?1015446

Source: cve@mitre.org

Patch

http://www.debian.de/security/2006/dsa-935

Source: cve@mitre.org

PatchVendor Advisory

http://www.gentoo.org/security/en/glsa/glsa-200601-05.xml

Source: cve@mitre.org

PatchVendor Advisory

http://www.giuseppetanzilli.it/mod_auth_pgsql2/

Source: cve@mitre.org

http://www.idefense.com/intelligence/vulnerabilities/display.php?id=367

Source: cve@mitre.org

PatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2006:009

Source: cve@mitre.org

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00015.html

Source: cve@mitre.org

Patch

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00016.html

Source: cve@mitre.org

Patch

http://www.redhat.com/support/errata/RHSA-2006-0164.html

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/16153

Source: cve@mitre.org

Patch

http://www.trustix.org/errata/2006/0002/

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2006/0070

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10600

Source: cve@mitre.org

https://usn.ubuntu.com/239-1/

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U (unsafe URL)