pike: SQL injection vulnerability

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
dev-lang/pike	< 7.6.86	>= 7.6.86	All supported architectures

Related bugreports: #136065

A flaw in the input handling could lead to the execution of arbitrary SQL statements in the underlying PostgreSQL database.

2. Impact Information

Pike is a general purpose programming language, able to be used for multiple tasks.

Some input is not properly sanitised before being used in a SQL statement in the underlying PostgreSQL database.

A remote attacker could provide malicious input to a pike program, which might result in the execution of arbitrary SQL statements.

3. Resolution Information

There is no known workaround at this time.

All pike users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/pike-7.6.86"

4. References

Updated August 06, 2006

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.