The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them.

Vulnerability of SQL-Ledger: several vulnerabilities

Synthesis of the vulnerability 

Several vulnerabilities of SQL-Ledger notably permit a remote attacker to execute code.
Impacted systems: Debian, Unix (platform) ~ not comprehensive.
Severity of this alert: 3/4.
Number of vulnerabilities in this bulletin: 3.
Creation date: 18/12/2006.
Revision date: 29/01/2007.
Références of this alert: BID-21634, CVE-2006-4244, CVE-2006-4731, CVE-2006-5872, DSA-1239-1, VIGILANCE-VUL-6407.

Description of the vulnerability 

The SQL-Ledger program is an ERP system written in Perl language and with a web interface. Several vulnerabilities were corrected in SQL-Ledger.

An attacker can hijack session of a user. [severity:3/4; CVE-2006-4244]

The login.pl and admin.pl scripts do not check if the "terminal" variable contains "../", which permits an attacker to execute Perl code located on server. [severity:3/4; CVE-2006-4731]

The login.pl script do not sanitize a variable, which permits an attacker to execute Perl code located on server. This vulnerability also affects SQL-Ledger and LedgerSMB. [severity:3/4; BID-21634, CVE-2006-5872]
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This computer threat bulletin impacts software or systems such as Debian, Unix (platform) ~ not comprehensive.

Our Vigil@nce team determined that the severity of this security threat is important.

The trust level is of type confirmed by the editor, with an origin of intranet client.

This bulletin is about 3 vulnerabilities.

An attacker with a expert ability can exploit this computer vulnerability alert.

Solutions for this threat 

SQL-Ledger: version 2.6.21.
Version 2.6.21 is corrected:
  http://www.sql-ledger.org/

LedgerSMB: version 1.1.5.
Version 1.1.5 is corrected:
  http://sourceforge.net/project/showfiles.php?group_id=175965

Debian: new sql-ledger packages.
New packages are available:
  Source archives:
    http://security.debian.org/pool/updates/main/s/sql-ledger/sql-ledger_2.4.7-2sarge1.dsc
      Size/MD5 checksum: 655 0392c058e58df7deca105cddb2b40ca5
    http://security.debian.org/pool/updates/main/s/sql-ledger/sql-ledger_2.4.7-2sarge1.diff.gz
      Size/MD5 checksum: 18423 45d1d70cfa3c385bf74b38bcccbe584c
    http://security.debian.org/pool/updates/main/s/sql-ledger/sql-ledger_2.4.7.orig.tar.gz
      Size/MD5 checksum: 1695610 04c9ffe49045cad569c5a368d7ebaa76
  Architecture independent components:
    http://security.debian.org/pool/updates/main/s/sql-ledger/sql-ledger_2.4.7-2sarge1_all.deb
      Size/MD5 checksum: 1796848 9cd9a4cf9057efc57384fe952bf4751f
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service 

Vigil@nce provides a software vulnerabilities announce. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.