Openfire (ARCHIVED)

CallLogDAO in SIP Plugin enables SQL Injection

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: None
  • Fix Version/s: 3.6.1
  • Component/s: Plugins
  • Labels:
    None
  • Environment:

    All

  • Acceptance Test - Add?:
    No

Description

CallLogDAO in SIP Plugin is using prepared Statements.
But still inserting SQL Query values in the initialization String.

The values MUST be inserted in the prepared Statement via PreparedStatement Instance to prevent SQL Injection.

Issue Links

is related to

Bug - A problem which impairs or prevents the functions of the product. JM-629 Additional cross-site scripting bugs in login

  • Blocker - Blocks development and/or testing work, production could not run.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Bug - A problem which impairs or prevents the functions of the product. JM-1489 Authentication bypass allowing arbitrary code execution

  • Blocker - Blocks development and/or testing work, production could not run.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Guus der Kinderen added a comment -

This should fix problem #2 as described in http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt

Show
Guus der Kinderen added a comment - This should fix problem #2 as described in http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
Hide
Permalink
Guus der Kinderen added a comment -

I've linked the other JIRA issues that relate to the same security advisory to this JIRA issue.

Show
Guus der Kinderen added a comment - I've linked the other JIRA issues that relate to the same security advisory to this JIRA issue.

People

  • Assignee:
    Thiago Rocha Camargo
    Reporter:
    Thiago Rocha Camargo
Vote (1)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved:

Time Tracking

Estimated:
4h
Original Estimate - 4 hours
Remaining:
4h
Remaining Estimate - 4 hours
Logged:
Not Specified
Time Spent - Not Specified