Vulnerabilities > CVE-2005-1409 - Unspecified vulnerability in Postgresql

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(18202);
  script_version("1.18");
  script_cvs_date("Date: 2018/07/25 18:58:03");

  script_cve_id("CVE-2005-1409", "CVE-2005-1410");
  script_bugtraq_id(13475, 13476);

  script_name(english:"PostgreSQL < 8.0.3 Multiple Vulnerabilities");
  script_summary(english:"Checks for character conversion and tsearch2 module vulnerabilities in PostgreSQL");

  script_set_attribute(attribute:"synopsis", value:"The remote database server is affected by multiple vulnerabilities.");
 script_set_attribute(attribute:"description", value:
"According to its banner, the version of PostgreSQL installed on the
remote host may suffer from the following vulnerabilities :

  - Character Conversion Vulnerability
    Unprivileged users can call functions supporting client-
    server character set conversion from SQL commands even
    though those functions do not validate their arguments.

  - tsearch2 Vulnerability
    If installed, the 'contrib/tsearch2' module permits
    users
    to at a minimum crash the backend because it misdeclares
    several functions as returning type 'internal' when in
    fact they do not have any 'internal' argument.");
  script_set_attribute(attribute:"see_also", value:"http://www.postgresql.org/about/news.315");
  # http://web.archive.org/web/20080820000033/http://developer.postgresql.org/docs/postgres/release-8-0-3.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7969c3a5");
  script_set_attribute(attribute:"solution", value:
"Implement the changes described in the PostgreSQL advisory or upgrade
to 8.0.3.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2005/05/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2005/05/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/05/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:postgresql:postgresql");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");
  script_copyright(english:"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.");

 script_dependencies("postgresql_detect.nasl");
 script_require_ports("Services/postgresql", 5432);

 exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

port = get_service(svc:"postgresql", default:5432, exit_on_fail:TRUE);


# Request the database 'template1' as the user 'postgres' or 'pgsql'.
zero = raw_string(0x00);
user[0] = "postgres";
user[1] = "pgsql";

for (i=0; i<2; i=i+1) {
  soc = open_sock_tcp(port);
  if (!soc) audit(AUDIT_PORT_CLOSED, port);

  usr = user[i];
  len = 224 - strlen(usr);
  req = raw_string(
          0x00, 0x00, 0x01, 0x28, 0x00, 0x02,
          0x00, 0x00, 0x74, 0x65, 0x6D, 0x70, 0x6C, 0x61,
          0x74, 0x65, 0x31
        ) +
        crap(data:zero, length:55) +
        usr +
        crap(data:zero, length:len);

  send(socket:soc, data:req);
  res = recv(socket:soc, length:5);
  res2 = recv(socket:soc, length:1024);
  if ((res[0]=="R") && (strlen(res2) == 10)) {
    req = raw_string(0x51) +
          "select version();" +
    	  raw_string(0x00);
    send(socket:soc, data:req);
    res = recv(socket:soc, length:65535);
    res = strstr(res, "PostgreSQL");

    if (res != NULL) {
      for (i=0; i<strlen(res); i++) {
        if (ord(res[i]) == 0) break;
      }
      res = substr(res, 0, i-1);
      # nb: the vulnerabilities affect 7.3.0 - 8.0.2.
      if (ereg(string:res, pattern:"PostgreSQL (7\.[34]|8\.0\.[0-2][^0-9])")){
     	security_warning(port);
      }
    }
    else if ("ERROR: function version()" >< res && report_paranoia > 1) security_warning(port);
    exit(0);
  }
}

#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Mandrake Linux Security Advisory MDKSA-2005:093. 
# The text itself is copyright (C) Mandriva S.A.
#

include("compat.inc");

if (description)
{
  script_id(18411);
  script_version ("1.17");
  script_cvs_date("Date: 2019/08/02 13:32:47");

  script_cve_id("CVE-2005-1409", "CVE-2005-1410");
  script_xref(name:"MDKSA", value:"2005:093");

  script_name(english:"Mandrake Linux Security Advisory : postgresql (MDKSA-2005:093)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Mandrake Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"A number of vulnerabilities were found and corrected in the PostgreSQL
DBMS :

Two serious security errors have been found in PostgreSQL 7.3 and
newer releases. These errors at least allow an unprivileged database
user to crash the backend process, and may make it possible for an
unprivileged user to gain the privileges of a database superuser.

Functions that support client-to-server character set conversion can
be called from SQL commands by unprivileged users, but these functions
are not designed to be safe against malicious choices of argument
values. (CVE-2005-1409)

The contrib/tsearch2 module misdeclares several functions as returning
type 'internal' when they do not have any 'internal' argument. This
breaks the type safety of 'internal' by allowing users to construct
SQL commands that invoke other functions accepting 'internal'
arguments. (CVE-2005-1410)

These vulnerabilities must also be fixed in all existing databases
when upgrading. The post-installation script of the updated
postgresql-server package attempts to do this automatically.

The updated packages have been patched to correct these problems."
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64ecpg3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64ecpg3-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64pgtcl2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64pgtcl2-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64pq3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64pq3-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libecpg3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libecpg3-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpgtcl2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpgtcl2-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpq3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpq3-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-contrib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-jdbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-pl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-plperl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-plpgsql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-plpython");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-pltcl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-tcl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql-test");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.1");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:mandrakesoft:mandrake_linux:le2005");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/05/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/06/02");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
  script_family(english:"Mandriva Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);


flag = 0;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64ecpg3-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64ecpg3-devel-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64pgtcl2-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64pgtcl2-devel-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64pq3-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"amd64", reference:"lib64pq3-devel-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libecpg3-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libecpg3-devel-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libpgtcl2-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libpgtcl2-devel-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libpq3-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", cpu:"i386", reference:"libpq3-devel-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-contrib-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-devel-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-docs-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-jdbc-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-pl-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-server-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-tcl-7.4.1-2.5.100mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.0", reference:"postgresql-test-7.4.1-2.5.100mdk", yank:"mdk")) flag++;

if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64ecpg3-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64ecpg3-devel-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64pgtcl2-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64pgtcl2-devel-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64pq3-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64pq3-devel-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libecpg3-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libecpg3-devel-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libpgtcl2-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libpgtcl2-devel-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libpq3-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libpq3-devel-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-contrib-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-devel-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-docs-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-jdbc-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-pl-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-server-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-tcl-7.4.5-4.3.101mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.1", reference:"postgresql-test-7.4.5-4.3.101mdk", yank:"mdk")) flag++;

if (rpm_check(release:"MDK10.2", cpu:"x86_64", reference:"lib64ecpg3-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", cpu:"x86_64", reference:"lib64ecpg3-devel-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", cpu:"x86_64", reference:"lib64pq3-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", cpu:"x86_64", reference:"lib64pq3-devel-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"libecpg3-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"libecpg3-devel-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"libpq3-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"libpq3-devel-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-contrib-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-devel-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-docs-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-jdbc-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-pl-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-plperl-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-plpgsql-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-plpython-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-pltcl-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-server-8.0.1-6.1.102mdk", yank:"mdk")) flag++;
if (rpm_check(release:"MDK10.2", reference:"postgresql-test-8.0.1-6.1.102mdk", yank:"mdk")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 200505-12.
#
# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(18271);
  script_version("1.18");
  script_cvs_date("Date: 2019/08/02 13:32:42");

  script_cve_id("CVE-2005-1409", "CVE-2005-1410");
  script_xref(name:"GLSA", value:"200505-12");

  script_name(english:"GLSA-200505-12 : PostgreSQL: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-200505-12
(PostgreSQL: Multiple vulnerabilities)

    PostgreSQL gives public EXECUTE access to a number of character
    conversion routines, but doesn't validate the given arguments
    (CAN-2005-1409). It has also been reported that the contrib/tsearch2
    module of PostgreSQL misdeclares the return value of some functions as
    'internal' (CAN-2005-1410).
  
Impact :

    An attacker could call the character conversion routines with specially
    setup arguments to crash the backend process of PostgreSQL or to
    potentially gain administrator rights. A malicious user could also call
    the misdeclared functions of the contrib/tsearch2 module, resulting in
    a Denial of Service or other, yet uninvestigated, impacts.
  
Workaround :

    There is no known workaround at this time."
  );
  # http://www.postgresql.org/about/news.315
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.postgresql.org/about/news.315/"
  );
  # http://www.postgresql.org/about/news.315
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.postgresql.org/about/news.315/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/200505-12"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All PostgreSQL users should update to the latest available version and
    follow the guide at http://www.postgresql.o
    rg/about/news.315
    # emerge --sync
    # emerge --ask --oneshot --verbose dev-db/postgresql"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/05/17");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-db/postgresql", unaffected:make_list("eq 7.3*", "eq 7.4*", "rge 8.0.1-r3", "ge 8.0.2-r1"), vulnerable:make_list("lt 7.3.10", "lt 7.4.7-r2", "lt 8.0.2-r1"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PostgreSQL");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2005:433. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(18408);
  script_version ("1.26");
  script_cvs_date("Date: 2019/10/25 13:36:11");

  script_cve_id("CVE-2005-1409", "CVE-2005-1410");
  script_xref(name:"RHSA", value:"2005:433");

  script_name(english:"RHEL 3 / 4 : postgresql (RHSA-2005:433)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated postgresql packages that fix several security vulnerabilities
and risks of data loss are now available.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system
(DBMS) that supports almost all SQL constructs (including
transactions, subselects and user-defined types and functions).

The PostgreSQL community discovered two distinct errors in initial
system catalog entries that could allow authorized database users to
crash the database and possibly escalate their privileges. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CVE-2005-1409 and CVE-2005-1410 to these issues.

Although installing this update will protect new (freshly initdb'd)
database installations from these errors, administrators MUST TAKE
MANUAL ACTION to repair the errors in pre-existing databases. The
appropriate procedures are explained at
http://www.postgresql.org/docs/8.0/static/release-7-4-8.html for Red
Hat Enterprise Linux 4 users, or
http://www.postgresql.org/docs/8.0/static/release-7-3-10.html for Red
Hat Enterprise Linux 3 users.

This update corrects several problems that might occur while trying to
upgrade a Red Hat Enterprise Linux 3 installation (containing
rh-postgresql packages) to Red Hat Enterprise Linux 4 (containing
postgresql packages). These updated packages correctly supersede the
rh-postgresql packages.

The original release of Red Hat Enterprise Linux 4 failed to
initialize the database correctly if started for the first time with
SELinux in enforcement mode. This update corrects that problem.

If you already have a nonfunctional database in place, shut down the
postgresql service if running, install this update, then do 'sudo rm
-rf /var/lib/pgsql/data' before restarting the postgresql service.

This update also solves the problem that the PostgreSQL server might
fail to restart after a system reboot, due to a stale lockfile.

This update also corrects a problem with wrong error messages in
libpq, the postgresql client library. The library would formerly
report kernel error messages incorrectly when the locale setting was
not C.

This update also includes fixes for several other errors, including
two race conditions that could result in apparent data inconsistency
or actual data loss.

All users of PostgreSQL are advised to upgrade to these updated
packages and to apply the recommended manual corrections to existing
databases."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2005-1409"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2005-1410"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2005:433"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-contrib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-jdbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-pl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-tcl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-test");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-contrib");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-docs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-jdbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-pl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-python");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-tcl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rh-postgresql-test");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");

  script_set_attribute(attribute:"vuln_publication_date", value:"2005/05/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2005/06/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/06/02");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^(3|4)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 3.x / 4.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2005:433";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-contrib-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-devel-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-docs-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-jdbc-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-libs-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-pl-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-python-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-server-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-tcl-7.3.10-1")) flag++;
  if (rpm_check(release:"RHEL3", reference:"rh-postgresql-test-7.3.10-1")) flag++;

  if (rpm_check(release:"RHEL4", reference:"postgresql-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-contrib-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-devel-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-docs-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-jdbc-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-libs-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-pl-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-python-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-server-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-tcl-7.4.8-1.RHEL4.1")) flag++;
  if (rpm_check(release:"RHEL4", reference:"postgresql-test-7.4.8-1.RHEL4.1")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
  }
}

• name	Aharon Chernin
  organization	SCAP.com, LLC

• name	Dragos Prisaca
  organization	G2, Inc.

• comment	The operating system installed on the system is Red Hat Enterprise Linux 3
  oval	oval:org.mitre.oval:def:11782

• comment	CentOS Linux 3.x
  oval	oval:org.mitre.oval:def:16651

• comment	The operating system installed on the system is Red Hat Enterprise Linux 4
  oval	oval:org.mitre.oval:def:11831

• comment	CentOS Linux 4.x
  oval	oval:org.mitre.oval:def:16636

• comment	Oracle Linux 4.x
  oval	oval:org.mitre.oval:def:15990