Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name CVE-2011-2688 First vendor Publication 2011-07-28
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2688

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13038
 
Oval ID: oval:org.mitre.oval:def:13038
Title: DSA-2279-1 libapache2-mod-authnz-external -- SQL injection
Description: It was discovered that libapache2-mod-authnz-external, an apache authentication module, is prone to an SQL injection via the $user paramter.
Family: unix Class: patch
Reference(s): DSA-2279-1
CVE-2011-2688
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): libapache2-mod-authnz-external
Definition Synopsis:

OpenVAS Exploits

Date Description
2012-02-12 Name : Gentoo Security Advisory GLSA 201110-23 (mod_authnz_external)
File : nvt/glsa_201110_23.nasl
2011-08-03 Name : Debian Security Advisory DSA 2279-1 (libapache2-mod-authnz-external)
File : nvt/deb_2279_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
74120 Apache HTTP Server mod_authnz_external mysql/mysql-auth.pl user Field SQL Inj...

The mod_authnz_external module for Apache HTTP Server contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'mysql/mysql-auth.pl' script not properly sanitizing user-supplied input to the 'user' field. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Nessus® Vulnerability Scanner

Date Description
2011-10-26 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201110-23.nasl - Type : ACT_GATHER_INFO
2011-07-20 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2279.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://anders.fix.no/software/#unix
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633637
http://code.google.com/p/mod-auth-external/issues/detail?id=5
http://secunia.com/advisories/45240
http://www.debian.org/security/2011/dsa-2279
http://www.openwall.com/lists/oss-security/2011/07/12/10
http://www.openwall.com/lists/oss-security/2011/07/12/17
http://www.securityfocus.com/bid/48653
https://exchange.xforce.ibmcloud.com/vulnerabilities/68799
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
Date Informations
2024-11-28 23:04:36
  • Multiple Updates
2024-11-28 12:26:16
  • Multiple Updates
2020-11-17 00:22:45
  • Multiple Updates
2020-05-23 01:44:53
  • Multiple Updates
2020-05-23 00:29:00
  • Multiple Updates
2017-08-29 09:23:18
  • Multiple Updates
2016-06-28 18:43:21
  • Multiple Updates
2016-04-26 20:53:13
  • Multiple Updates
2014-02-17 11:03:34
  • Multiple Updates
2013-05-10 23:03:37
  • Multiple Updates