Apache mod_authnz_external: SQL injection

Apache mod_authnz_external: SQL injection An input sanitation flaw in mod_authnz_external allows remote attacker to conduct SQL injection. mod_authnz_external October 25, 2011 October 25, 2011: 1 386165 remote 3.2.6 3.2.6

mod_authnz_external is a tool for creating custom authentication backends for HTTP basic authentication.

mysql/mysql-auth.pl in mod_authnz_external does not properly sanitize input before using it in an SQL query.

A remote attacker could exploit this vulnerability to inject arbitrary SQL statements by using a specially crafted username for HTTP authentication on a site using mod_authnz_external.

There is no known workaround at this time.

All Apache mod_authnz_external users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose
      ">=www-apache/mod_authnz_external-3.2.6"

CVE-2011-2688 underling a3li