Bug#369351: exim4-daemon-heavy: Insecure quote escaping in PostgreSQL backend

[Martin Pitt]

Package: exim4-daemon-heavy
Severity: important
Version: 4.60-3
Tags: security

Hi!

Recently, a security hole has been discovered in PostgreSQL client
applications, see http://www.postgresql.org/docs/techdocs.50 for
details. In short, using \' for quote escaping is insecure and now not
allowed any more in some encodings which are prone to this SQL
injection attack. This has been assigned CVE-2006-2314.

./src/lookups/pgsql.c, pgsql_quote() currently uses \' to
escape quoting, which makes it vulnerable against this attack with
earlier PostgreSQL versions, and will break with the current one
(since it disables this method of quote escaping by default in
affected client encodings). A quick fix is to change the function to
use '' instead of \', but a better fix is to completely replace the
loop with an invocation of PQescapeString() from libpq. 

Please be aware that this also affects other database backends in
principle (unless they do not support the affected encodings). Also,
'' is the SQL standard escape for ', not \'.

Please also pass this to upstream.

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

In a world without walls and fences, who needs Windows and Gates?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 191 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-exim4-maintainers/attachments/20060529/92cae21b/attachment.pgp