diff options
| author | skv <skv@FreeBSD.org> | 2010-02-09 00:38:40 +0800 |
|---|---|---|
| committer | skv <skv@FreeBSD.org> | 2010-02-09 00:38:40 +0800 |
| commit | dc4811f412d22e5554d84be32c9c1decf6123f6e (patch) | |
| tree | 6c6253d1ce60a4327274a32341fe8d30a0d6819e /security | |
| parent | 0084ecd093b7004364869b5bdcc9e6d0defe1234 (diff) | |
| download | freebsd-ports-gnome-dc4811f412d22e5554d84be32c9c1decf6123f6e.tar.gz freebsd-ports-gnome-dc4811f412d22e5554d84be32c9c1decf6123f6e.tar.zst freebsd-ports-gnome-dc4811f412d22e5554d84be32c9c1decf6123f6e.zip | |
Document "otrs" - SQL injection.
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index c257ab8f2cd1..618222ca6d47 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,40 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="6b575419-14cf-11df-a628-001517351c22"> + <topic>otrs -- SQL injection</topic> + <affects> + <package> + <name>otrs</name> + <range><lt>2.4.7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>OTRS Security Advisory reports:</p> + <blockquote cite="http://otrs.org/advisory/OSA-2010-01-en/"> + <p>Missing security quoting for SQL statements allows agents and + customers to manipulate SQL queries. So it's possible for + authenticated users to inject SQL queries + via string manipulation of statements.</p> + <p>A malicious user may be able to manipulate SQL queries to read + or modify records in the database. This way it could also be + possible to get access to more permissions (e. g. administrator + permissions).</p> + <p>To use this vulnerability the malicious user needs to have + a valid Agent- or Customer-session.</p> + </blockquote> + </body> + </description> + <references> + <url>http://otrs.org/advisory/OSA-2010-01-en/</url> + </references> + <dates> + <discovery>2010-02-08</discovery> + <entry>2010-02-08</entry> + </dates> + </vuln> + <vuln vid="cae01d7b-110d-11df-955a-00219b0fc4d8"> <topic>apache -- Prevent chunk-size integer overflow on platforms where sizeof(int) < sizeof(long)</topic> <affects> |