[Pkg-nagios-devel] Bug#369362: nagios: Insecure quote escaping in
mpitt at debian.org
Mon May 29 11:09:19 UTC 2006
Recently, a security hole has been discovered in PostgreSQL client
applications, see http://www.postgresql.org/docs/techdocs.50 for
details. In short, using \' for quote escaping is insecure and now not
allowed any more in some encodings which are prone to this SQL
injection attack. This has been assigned CVE-2006-2314.
The various xdata/xr*.c modules currently use \' to escape quotes, which makes
it vulnerable against this attack with earlier PostgreSQL versions, and will
break with the current one (since it disables this method of quote escaping by
default in affected client encodings). The database query quoting should be
changed to use '' instead of \', but a better fix is to completely replace
custom quoting with an invocation of PQescapeString() from libpq.
Please be aware that this also affects other database backends in principle
(unless they do not support the affected encodings). Also, '' is the SQL
standard escape for ', not \'.
Please also pass this to upstream.
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org
In a world without walls and fences, who needs Windows and Gates?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 191 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-nagios-devel/attachments/20060529/17a2cd38/attachment.pgp
More information about the Pkg-nagios-devel