FreeBSD : trac -- search module SQL injection vulnerability (7289187b-66a5-11da-99f6-00123ffe8333)

NASLDB: FreeBSD : trac -- search module SQL injection vulnerability (7289187b-66a5-11da-99f6-00123ffe8333)

General

ID: 21452
Name: FreeBSD : trac — search module SQL injection vulnerability (7289187b-66a5-11da-99f6-00123ffe8333)

Summary: Checks for updated package in pkg_info output

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: –
CVSS Temporal Vector: –

Port: 0
Family: FreeBSD Local Security Checks
Type: Local

Description

Secunia reports :

A vulnerability has been reported in Trac, which can be exploited by
malicious people to conduct SQL injection attacks.

Some unspecified input passed in the search module isn’t properly
sanitised before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code.

Exploiting

Exploit Available: –
Exploitability Ease: –

Sources

CVE: –
OSVDB: –
Bugtraq: –
scipID: –

Timeline

Vulnerability Disclosure: 2005/12/05
Patch Release: 2005/12/07
Plugin Release: 2006/05/13

Plugin

Version: 1.9
Filename: freebsd_pkg_7289187b66a511da99f600123ffe8333.nasl
Filesize: 4375 bytes
MD5 Hash: 3c9811dcde173e08d66db314ccbdadd5

Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info
Dependencies: "ssh_get_info.nasl"