A vulnerability has been reported in libpam-pgsql, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to the "pg_execParam()" function in src/backend_pgsql.c using an incorrect format specifier, which can be exploited to cause a heap-based buffer overflow by e.g. connecting from an IPv4 address containing an octet larger than 127 to an application using the module.

The vulnerability is reported in version 0.7.1. Other versions may also be affected.

Solution
Do not use a vulnerable version of the module.

Provided and/or discovered by
Krzysztof Galazka within a Debian bug report.

Original Advisory
Debian bug #603436:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=603436

Deep Links
Links available to Secunia VIM customers