| Revision Date: | 2013-04-29 | Version: | 11 | | Title: | PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem. | | Description: | PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem. | | Family: | unix | Class: | vulnerability | | Status: | ACCEPTED | Reference(s): | CVE-2006-2314
| | Platform(s): | CentOS Linux 3
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 3
Red Hat Enterprise Linux 4
| Product(s): | | | Definition Synopsis | | OS Section: RHEL3, CentOS3 RHEL3 or CentOS3
The operating system installed on the system is Red Hat Enterprise Linux 3
OR CentOS Linux 3.x
AND Configuration section
rh-postgresql-devel is earlier than 0:7.3.15-2
OR rh-postgresql-server is earlier than 0:7.3.15-2
OR rh-postgresql-python is earlier than 0:7.3.15-2
OR rh-postgresql-libs is earlier than 0:7.3.15-2
OR rh-postgresql-docs is earlier than 0:7.3.15-2
OR rh-postgresql-test is earlier than 0:7.3.15-2
OR rh-postgresql-pl is earlier than 0:7.3.15-2
OR rh-postgresql-tcl is earlier than 0:7.3.15-2
OR rh-postgresql is earlier than 0:7.3.15-2
OR rh-postgresql-contrib is earlier than 0:7.3.15-2
OR rh-postgresql-jdbc is earlier than 0:7.3.15-2
OR OS Section: RHEL4, CentOS4, Oracle Linux 4
RHEL4, CentOS4 or Oracle Linux 4
The operating system installed on the system is Red Hat Enterprise Linux 4
OR CentOS Linux 4.x
OR Oracle Linux 4.x
AND Configuration section
postgresql is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-docs is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-pl is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-tcl is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-libs is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-contrib is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-python is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-test is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-jdbc is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-server is earlier than 0:7.4.13-2.RHEL4.1
OR postgresql-devel is earlier than 0:7.4.13-2.RHEL4.1
|
|