Vulnerabilities > CVE-2003-0901 - Unspecified vulnerability in Postgresql

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
postgresql
nessus

Summary

Buffer overflow in to_ascii for PostgreSQL 7.2.x, and 7.3.x before 7.3.4, allows remote attackers to execute arbitrary code.

Nessus

  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2003-102.NASL
    descriptionTwo bugs were discovered that lead to a buffer overflow in PostgreSQL versions 7.2.x and 7.3.x prior to 7.3.4, in the abstract data type (ADT) to ASCII conversion functions. It is believed that, under the right circumstances, an attacker may use this vulnerability to execute arbitrary instructions on the PostgreSQL server. The provided packages are patched to protect against this vulnerability and all users are encouraged to upgrade immediately.
    last seen2020-06-01
    modified2020-06-02
    plugin id14084
    published2004-07-31
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/14084
    titleMandrake Linux Security Advisory : postgresql (MDKSA-2003:102)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2003:102. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(14084);
      script_version ("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:47");
    
      script_cve_id("CVE-2003-0901");
      script_xref(name:"MDKSA", value:"2003:102");
    
      script_name(english:"Mandrake Linux Security Advisory : postgresql (MDKSA-2003:102)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Two bugs were discovered that lead to a buffer overflow in PostgreSQL
    versions 7.2.x and 7.3.x prior to 7.3.4, in the abstract data type
    (ADT) to ASCII conversion functions. It is believed that, under the
    right circumstances, an attacker may use this vulnerability to execute
    arbitrary instructions on the PostgreSQL server.
    
    The provided packages are patched to protect against this
    vulnerability and all users are encouraged to upgrade immediately."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libecpg3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libecpg3-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpgperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpgsql2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpgsqlodbc0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpgtcl2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpgtcl2-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpq3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpq3-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-jdbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-pl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-tcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-tk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2003/11/03");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"libecpg3-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"libpgperl-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"libpgsql2-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"libpgsqlodbc0-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"libpgtcl2-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-contrib-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-devel-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-docs-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-jdbc-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-python-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-server-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-tcl-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-test-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"postgresql-tk-7.2.2-1.3.90mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libecpg3-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libecpg3-devel-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libpgtcl2-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libpgtcl2-devel-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libpq3-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"libpq3-devel-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-contrib-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-devel-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-docs-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-jdbc-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-pl-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-python-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-server-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-tcl-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.1", cpu:"i386", reference:"postgresql-test-7.3.2-5.1.91mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-397.NASL
    descriptionTom Lane discovered a buffer overflow in the to_ascii function in PostgreSQL. This allows remote attackers to execute arbitrary code on the host running the database.
    last seen2020-06-01
    modified2020-06-02
    plugin id15234
    published2004-09-29
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15234
    titleDebian DSA-397-1 : postgresql - buffer overflow
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-397. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(15234);
      script_version("1.18");
      script_cvs_date("Date: 2019/08/02 13:32:17");
    
      script_cve_id("CVE-2003-0901");
      script_bugtraq_id(8741);
      script_xref(name:"DSA", value:"397");
    
      script_name(english:"Debian DSA-397-1 : postgresql - buffer overflow");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Tom Lane discovered a buffer overflow in the to_ascii function in
    PostgreSQL. This allows remote attackers to execute arbitrary code on
    the host running the database."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.debian.org/security/2003/dsa-397"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the postgresql package.
    
    For the stable distribution (woody) this problem has been fixed in
    version 7.2.1-2woody4."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2003/11/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"3.0", prefix:"libecpg3", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"libpgperl", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"libpgsql2", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"libpgtcl", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"odbc-postgresql", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"pgaccess", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"postgresql", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"postgresql-client", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"postgresql-contrib", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"postgresql-dev", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"postgresql-doc", reference:"7.2.1-2woody4")) flag++;
    if (deb_check(release:"3.0", prefix:"python-pygresql", reference:"7.2.1-2woody4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2003-314.NASL
    descriptionUpdated PostgreSQL packages that correct a buffer overflow in the to_ascii routines are now available. PostgreSQL is an advanced Object-Relational database management system (DBMS). Two bugs that can lead to buffer overflows have been found in the PostgreSQL abstract data type to ASCII conversion routines. A remote attacker who is able to influence the data passed to the to_ascii functions may be able to execute arbitrary code in the context of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0901 to these issues. In addition, a bug that can lead to leaks has been found in the string to timestamp abstract data type conversion routine. If the input string to the to_timestamp() routine is shorter than what the template string is expecting, the routine will run off the end of the input string, resulting in a leak and unstable behaviour. Users of PostgreSQL are advised to upgrade to these erratum packages, which contain a backported patch that corrects these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id12430
    published2004-07-06
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/12430
    titleRHEL 2.1 : postgresql (RHSA-2003:314)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2003:314. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(12430);
      script_version ("1.27");
      script_cvs_date("Date: 2019/10/25 13:36:10");
    
      script_cve_id("CVE-2003-0901");
      script_bugtraq_id(8741);
      script_xref(name:"RHSA", value:"2003:314");
    
      script_name(english:"RHEL 2.1 : postgresql (RHSA-2003:314)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated PostgreSQL packages that correct a buffer overflow in the
    to_ascii routines are now available.
    
    PostgreSQL is an advanced Object-Relational database management system
    (DBMS).
    
    Two bugs that can lead to buffer overflows have been found in the
    PostgreSQL abstract data type to ASCII conversion routines. A remote
    attacker who is able to influence the data passed to the to_ascii
    functions may be able to execute arbitrary code in the context of the
    PostgreSQL server. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CVE-2003-0901 to these issues.
    
    In addition, a bug that can lead to leaks has been found in the string
    to timestamp abstract data type conversion routine. If the input
    string to the to_timestamp() routine is shorter than what the template
    string is expecting, the routine will run off the end of the input
    string, resulting in a leak and unstable behaviour.
    
    Users of PostgreSQL are advised to upgrade to these erratum packages,
    which contain a backported patch that corrects these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2003-0901"
      );
      # http://archives.postgresql.org/pgsql-bugs/2003-09/msg00014.php
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?2a5be090"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2003:314"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-jdbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-perl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-tcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-tk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2003/11/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2003/11/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^2\.1([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    if (cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i386", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2003:314";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-contrib-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-devel-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-docs-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-jdbc-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-libs-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-odbc-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-perl-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-python-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-server-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-tcl-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-test-7.1.3-5.rhel2.1AS")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"postgresql-tk-7.1.3-5.rhel2.1AS")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
      }
    }
    
  • NASL familyDatabases
    NASL idPOSTGRESQL_TOASCII_OVERFLOW.NASL
    descriptionAccording to its version number, the PostgreSQL server listening on this port is vulnerable to two buffer overflows in the to_ascii() function that could allow an attacker who can query the remote database to execute arbitrary code, subject to the privileges under which the service operates.
    last seen2020-06-01
    modified2020-06-02
    plugin id11916
    published2003-11-04
    reporterThis script is Copyright (C) 2003-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/11916
    titlePostgreSQL to_ascii() Function Remote Overflows

Redhat

advisories
  • rhsa
    idRHSA-2003:313
  • rhsa
    idRHSA-2003:314