Vulnerabilities > CVE-2009-4136 - Local Privilege Escalation vulnerability in PostgreSQL Index Function Session State Modification
Attack vector
NETWORK Attack complexity
LOW Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Vulnerable Configurations
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_11_2_POSTGRESQL-100111.NASL description An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 44054 published 2010-01-19 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44054 title openSUSE Security Update : postgresql (postgresql-1773) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update postgresql-1773. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(44054); script_version("1.8"); script_cvs_date("Date: 2019/10/25 13:36:38"); script_cve_id("CVE-2009-4034", "CVE-2009-4136"); script_name(english:"openSUSE Security Update : postgresql (postgresql-1773)"); script_summary(english:"Check for the postgresql-1773 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=564360" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=564710" ); script_set_attribute( attribute:"solution", value:"Update the affected postgresql packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_cwe_id(310); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.2"); script_set_attribute(attribute:"patch_publication_date", value:"2010/01/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/19"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.2", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-contrib-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-devel-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-libs-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-plperl-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-plpython-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-pltcl-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"postgresql-server-8.4.2-1.1.1") ) flag++; if ( rpm_check(release:"SUSE11.2", cpu:"x86_64", reference:"postgresql-libs-32bit-8.4.2-1.1.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc"); }
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201110-22.NASL description The remote host is affected by the vulnerability described in GLSA-201110-22 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote authenticated attacker could send a specially crafted SQL query to a PostgreSQL server with the last seen 2020-06-01 modified 2020-06-02 plugin id 56626 published 2011-10-25 reporter This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/56626 title GLSA-201110-22 : PostgreSQL: Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201110-22. # # The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(56626); script_version("1.12"); script_cvs_date("Date: 2019/08/12 17:35:38"); script_cve_id("CVE-2009-0922", "CVE-2009-3229", "CVE-2009-3230", "CVE-2009-3231", "CVE-2009-4034", "CVE-2009-4136", "CVE-2010-0442", "CVE-2010-0733", "CVE-2010-1169", "CVE-2010-1170", "CVE-2010-1447", "CVE-2010-1975", "CVE-2010-3433", "CVE-2010-4015", "CVE-2011-2483"); script_bugtraq_id(34090, 36314, 37333, 37334, 37973, 38619, 40215, 40304, 40305, 43747, 46084, 49241); script_xref(name:"GLSA", value:"201110-22"); script_name(english:"GLSA-201110-22 : PostgreSQL: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201110-22 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote authenticated attacker could send a specially crafted SQL query to a PostgreSQL server with the 'intarray' module enabled, possibly resulting in the execution of arbitrary code with the privileges of the PostgreSQL server process, or a Denial of Service condition. Furthermore, a remote authenticated attacker could execute arbitrary Perl code, cause a Denial of Service condition via different vectors, bypass LDAP authentication, bypass X.509 certificate validation, gain database privileges, exploit weak blowfish encryption and possibly cause other unspecified impact. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201110-22" ); script_set_attribute( attribute:"solution", value: "All PostgreSQL 8.2 users should upgrade to the latest 8.2 base version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-base-8.2.22:8.2' All PostgreSQL 8.3 users should upgrade to the latest 8.3 base version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-base-8.3.16:8.3' All PostgreSQL 8.4 users should upgrade to the latest 8.4 base version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-base-8.4.9:8.4' All PostgreSQL 9.0 users should upgrade to the latest 9.0 base version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-base-9.0.5:9.0' All PostgreSQL 8.2 server users should upgrade to the latest 8.2 server version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-8.2.22:8.2' All PostgreSQL 8.3 server users should upgrade to the latest 8.3 server version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-8.3.16:8.3' All PostgreSQL 8.4 server users should upgrade to the latest 8.4 server version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-8.4.9:8.4' All PostgreSQL 9.0 server users should upgrade to the latest 9.0 server version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-9.0.5:9.0' The old unsplit PostgreSQL packages have been removed from portage. Users still using them are urged to migrate to the new PostgreSQL packages as stated above and to remove the old package: # emerge --unmerge 'dev-db/postgresql'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(189, 264, 287, 310, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2009/03/17"); script_set_attribute(attribute:"patch_publication_date", value:"2011/10/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/25"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-db/postgresql-server", unaffected:make_list("ge 9.0.5", "rge 8.4.9", "rge 8.3.16", "rge 8.2.22", "rge 8.4.10", "rge 8.3.17", "rge 8.2.23", "ge 8.4.11", "ge 8.3.18"), vulnerable:make_list("lt 9.0.5"))) flag++; if (qpkg_check(package:"dev-db/postgresql", unaffected:make_list(), vulnerable:make_list("le 9"))) flag++; if (qpkg_check(package:"dev-db/postgresql-base", unaffected:make_list("ge 9.0.5", "rge 8.4.9", "rge 8.3.16", "rge 8.2.22", "rge 8.4.10", "rge 8.3.17", "rge 8.2.23", "ge 8.4.11", "ge 8.3.18"), vulnerable:make_list("lt 9.0.5"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PostgreSQL"); }
NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2010-0428.NASL description Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/7.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. last seen 2020-06-01 modified 2020-06-02 plugin id 46696 published 2010-05-24 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/46696 title CentOS 4 : postgresql (CESA-2010:0428) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2010:0428 and # CentOS Errata and Security Advisory 2010:0428 respectively. # include("compat.inc"); if (description) { script_id(46696); script_version("1.16"); script_cvs_date("Date: 2019/10/25 13:36:05"); script_cve_id("CVE-2009-4136", "CVE-2010-0442", "CVE-2010-0733", "CVE-2010-1168", "CVE-2010-1169", "CVE-2010-1170", "CVE-2010-1447", "CVE-2010-1975"); script_xref(name:"RHSA", value:"2010:0428"); script_name(english:"CentOS 4 : postgresql (CESA-2010:0428)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/7.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update." ); # https://lists.centos.org/pipermail/centos-announce/2010-May/016645.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?669521f0" ); # https://lists.centos.org/pipermail/centos-announce/2010-May/016646.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?369bfc61" ); script_set_attribute( attribute:"solution", value:"Update the affected postgresql packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(189); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-docs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-pl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-python"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-tcl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-test"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:4"); script_set_attribute(attribute:"vuln_publication_date", value:"2009/12/15"); script_set_attribute(attribute:"patch_publication_date", value:"2010/05/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/05/24"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 4.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-contrib-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-contrib-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-devel-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-devel-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-docs-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-docs-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-jdbc-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-jdbc-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-libs-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-libs-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-pl-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-pl-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-python-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-python-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-server-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-server-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-tcl-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-tcl-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-test-7.4.29-1.el4_8.1")) flag++; if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-test-7.4.29-1.el4_8.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc"); }
NASL family SuSE Local Security Checks NASL id SUSE_11_1_POSTGRESQL-100108.NASL description An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 44052 published 2010-01-19 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44052 title openSUSE Security Update : postgresql (postgresql-1773) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update postgresql-1773. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(44052); script_version("1.8"); script_cvs_date("Date: 2019/10/25 13:36:38"); script_cve_id("CVE-2009-4034", "CVE-2009-4136"); script_name(english:"openSUSE Security Update : postgresql (postgresql-1773)"); script_summary(english:"Check for the postgresql-1773 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=564360" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=564710" ); script_set_attribute( attribute:"solution", value:"Update the affected postgresql packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_cwe_id(310); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1"); script_set_attribute(attribute:"patch_publication_date", value:"2010/01/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/19"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-contrib-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-devel-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-libs-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-plperl-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-plpython-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-pltcl-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", reference:"postgresql-server-8.3.9-0.1.1") ) flag++; if ( rpm_check(release:"SUSE11.1", cpu:"x86_64", reference:"postgresql-libs-32bit-8.3.9-0.1.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc"); }
NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2010-0427.NASL description From Red Hat Security Advisory 2010:0427 : Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Running PostgreSQL instances must be restarted ( last seen 2020-06-01 modified 2020-06-02 plugin id 68042 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68042 title Oracle Linux 3 : postgresql (ELSA-2010-0427) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2010-0427.NASL description Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Running PostgreSQL instances must be restarted ( last seen 2020-06-01 modified 2020-06-02 plugin id 46681 published 2010-05-20 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/46681 title RHEL 3 : postgresql (RHSA-2010:0427) NASL family SuSE Local Security Checks NASL id SUSE9_12571.NASL description The following bugs have been fixed : - An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) - Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 44050 published 2010-01-19 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44050 title SuSE9 Security Update : PostgreSQL (YOU Patch Number 12571) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2010-0429.NASL description Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 8.1.21. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/8.1/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. last seen 2020-06-01 modified 2020-06-02 plugin id 46761 published 2010-06-01 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/46761 title CentOS 5 : postgresql (CESA-2010:0429) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2010-0429.NASL description From Red Hat Security Advisory 2010:0429 : Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 8.1.21. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/8.1/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. last seen 2020-06-01 modified 2020-06-02 plugin id 68044 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68044 title Oracle Linux 5 : postgresql (ELSA-2010-0429) NASL family Fedora Local Security Checks NASL id FEDORA_2009-13381.NASL description Update to latest upstream point releases Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43340 published 2009-12-18 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43340 title Fedora 12 : postgresql-8.4.2-1.fc12 (2009-13381) NASL family SuSE Local Security Checks NASL id SUSE_POSTGRESQL-6768.NASL description The following bugs have been fixed : An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 49920 published 2010-10-11 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/49920 title SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6768) NASL family SuSE Local Security Checks NASL id SUSE_11_POSTGRESQL-100111.NASL description The following bugs have been fixed : - An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) - Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 52689 published 2011-03-17 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/52689 title SuSE 11 Security Update : PostgreSQL (SAT Patch Number 1766) NASL family SuSE Local Security Checks NASL id SUSE_POSTGRESQL-6767.NASL description The following bugs have been fixed : An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 44056 published 2010-01-19 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44056 title SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6767) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2010-0429.NASL description Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 8.1.21. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/8.1/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. last seen 2020-06-01 modified 2020-06-02 plugin id 46683 published 2010-05-20 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/46683 title RHEL 5 : postgresql (RHSA-2010:0429) NASL family Databases NASL id POSTGRESQL_20091214.NASL description The version of PostgreSQL installed on the remote host is 7.4 prior to 7.4.27, 8.0 prior to 8.0.23, 8.1 prior to 8.1.19, 8.2 prior to 8.2.15, 8.3 prior to 8.3.9 or 8.4 prior to 8.4.2. As such, it is potentially affected by multiple vulnerabilities : - NULL bytes in SSL Certificates can be used to falsify client or server authentication. (CVE-2009-4034) - Privilege escalation is possible via changing session state in an index function. (CVE-2009-4136) last seen 2020-06-01 modified 2020-06-02 plugin id 63348 published 2012-12-28 reporter This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63348 title PostgreSQL 7.4 < 7.4.27 / 8.0 < 8.0.23 / 8.1 < 8.1.19 / 8.2 < 8.2.15 / 8.3 < 8.3.9 / 8.4 < 8.4.2 Multiple Vulnerabilities NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2010-0428.NASL description Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/7.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. last seen 2020-06-01 modified 2020-06-02 plugin id 46682 published 2010-05-20 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/46682 title RHEL 4 : postgresql (RHSA-2010:0428) NASL family SuSE Local Security Checks NASL id SUSE_11_POSTGRESQL-100108.NASL description The following bugs have been fixed : - An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) - Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 44055 published 2010-01-19 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44055 title SuSE 11 Security Update : PostgreSQL (SAT Patch Number 1766) NASL family SuSE Local Security Checks NASL id SUSE_11_0_POSTGRESQL-100108.NASL description An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details. last seen 2020-06-01 modified 2020-06-02 plugin id 44051 published 2010-01-19 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44051 title openSUSE Security Update : postgresql (postgresql-1773) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_E7BC5600EAA011DEBD9C00215C6A37BB.NASL description PostgreSQL project reports : PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a last seen 2020-06-01 modified 2020-06-02 plugin id 43177 published 2009-12-17 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43177 title FreeBSD : postgresql -- multiple vulnerabilities (e7bc5600-eaa0-11de-bd9c-00215c6a37bb) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2010-0428.NASL description From Red Hat Security Advisory 2010:0428 : Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/7.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. last seen 2020-06-01 modified 2020-06-02 plugin id 68043 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68043 title Oracle Linux 4 : postgresql (ELSA-2010-0428) NASL family Scientific Linux Local Security Checks NASL id SL_20100519_POSTGRESQL_ON_SL3_X.NASL description PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) If the postgresql service is running, it will be automatically restarted after installing this update. last seen 2020-06-01 modified 2020-06-02 plugin id 60795 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60795 title Scientific Linux Security Update : postgresql on SL3.x, SL4.x, SL5.x i386/x86_64 NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2010-0427.NASL description Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Running PostgreSQL instances must be restarted ( last seen 2020-06-01 modified 2020-06-02 plugin id 46695 published 2010-05-24 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/46695 title CentOS 3 : postgresql (CESA-2010:0427) NASL family Fedora Local Security Checks NASL id FEDORA_2009-13363.NASL description Update to latest upstream point releases Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43337 published 2009-12-18 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43337 title Fedora 11 : postgresql-8.3.9-1.fc11 (2009-13363) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-876-1.NASL description It was discovered that PostgreSQL did not properly handle certificates with NULL characters in the Common Name field of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2009-4034) It was discovered that PostgreSQL did not properly manage session-local state. A remote authenticated user could exploit this to escalate priviliges within PostgreSQL. (CVE-2009-4136). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43622 published 2010-01-04 reporter Ubuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43622 title Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerabilities (USN-876-1) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2009-333.NASL description Multiple vulnerabilities was discovered and corrected in postgresql : NULL Bytes in SSL Certificates can be used to falsify client or server authentication. This only affects users who have SSL enabled, perform certificate name validation or client certificate authentication, and where the Certificate Authority (CA) has been tricked into issuing invalid certificates. The use of a CA that can be trusted to always issue valid certificates is recommended to ensure you are not vulnerable to this issue (CVE-2009-4034). Privilege escalation via changing session state in an index function. This closes a corner case related to vulnerabilities CVE-2009-3230 and CVE-2007-6600 (CVE-2009-4136). Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations (CVE-2010-0733). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers This update provides a solution to these vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 43167 published 2009-12-16 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43167 title Mandriva Linux Security Advisory : postgresql (MDVSA-2009:333) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1964.NASL description Several vulnerabilities have been discovered in PostgreSQL, a database server. The Common Vulnerabilities and Exposures project identifies the following problems : It was discovered that PostgreSQL did not properly verify the Common Name attribute in X.509 certificates, enabling attackers to bypass the (optional) TLS protection on client-server connections, by relying on a certificate from a trusted CA which contains an embedded NUL byte in the Common Name (CVE-2009-4034 ). Authenticated database users could elevate their privileges by creating specially crafted index functions (CVE-2009-4136 ). The following matrix shows fixed source package versions for the respective distributions. oldstable/etch stable/lenny testing/unstable postgresql-7.4 7.4.27-0etch1 postgresql-8.1 8.1.19-0etch1 postgresql-8.3 8.3.9-0lenny1 8.3.9-1 postgresql-8.4 8.4.2-1 In addition to these security fixes, the updates contain reliability improvements and fix other defects. last seen 2020-06-01 modified 2020-06-02 plugin id 44829 published 2010-02-24 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44829 title Debian DSA-1964-1 : postgresql-7.4, postgresql-8.1, postgresql-8.3 - several vulnerabilities
Oval
accepted | 2013-04-29T04:18:56.517-04:00 | ||||||||||||||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||||||||||||||
contributors |
| ||||||||||||||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||||||||||||||
description | PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230. | ||||||||||||||||||||||||||||||||
family | unix | ||||||||||||||||||||||||||||||||
id | oval:org.mitre.oval:def:9358 | ||||||||||||||||||||||||||||||||
status | accepted | ||||||||||||||||||||||||||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||||||||||||||
title | PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230. | ||||||||||||||||||||||||||||||||
version | 27 |
Redhat
advisories |
| ||||||||||||
rpms |
|
Seebug
bulletinFamily exploit description BUGTRAQ ID: 37333 CVE ID: CVE-2009-4136 PostgreSQL是一款高级对象-关系型数据库管理系统,支持扩展的SQL标准子集。 PostgreSQL在执行数据库超级用户的索引功能期间没有正确地管理session-local状态,这允许通过认证的远程攻击者通过带有特制索引功能的表格获得权限提升。 PostgreSQL PostgreSQL 8.4.x PostgreSQL PostgreSQL 8.3.x PostgreSQL PostgreSQL 8.2.x PostgreSQL PostgreSQL 8.1.x PostgreSQL PostgreSQL 8.0.x PostgreSQL PostgreSQL 7.4.x 厂商补丁: PostgreSQL ---------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.postgresql.org/about/news.1170 Sun --- Sun已经为此发布了一个安全公告(Sun-Alert-6909139)以及相应补丁: Sun-Alert-6909139:Security Vulnerabilities in PostgreSQL Shipped With Solaris May Allow Escalation of Privileges or Man-in-the-Middle on SSL Connections 链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-274870-1 id SSV:15153 last seen 2017-11-19 modified 2009-12-29 published 2009-12-29 reporter Root title PostgreSQL索引功能权限提升漏洞 bulletinFamily exploit description Bugraq ID: 37322 CVE ID:CVE-2009-4136 Ruby on Rails是一款Web应用程序框架,构建在Ruby语言之上。 Ruby on Rails 'protect_from_forgery'存在跨站请求伪造攻击,远程攻击者可以利用漏洞执行部分管理员操作,获得对应用程序的未授权访问或删除部分数据。 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails 2.3.2 Ruby on Rails Ruby on Rails 2.2.3 Ruby on Rails Ruby on Rails 2.2.2 Ruby on Rails Ruby on Rails 2.1.1 Ruby on Rails Ruby on Rails 2.1 Ruby on Rails Ruby on Rails 2.0.5 Ruby on Rails Ruby on Rails 2.0.4 Ruby on Rails Ruby on Rails 2.0 Ruby on Rails Ruby on Rails 1.2.6 Ruby on Rails Ruby on Rails 1.2.5 Ruby on Rails Ruby on Rails 1.2.3 Ruby on Rails Ruby on Rails 1.1.6 Ruby on Rails Ruby on Rails 1.1.5 Ruby on Rails Ruby on Rails 1.1.4 Ruby on Rails Ruby on Rails 1.1.3 Ruby on Rails Ruby on Rails 1.1.2 Ruby on Rails Ruby on Rails 1.1.1 Ruby on Rails Ruby on Rails 1.1 Ruby on Rails Ruby on Rails 1.0 Ruby on Rails Ruby on Rails 0.14 Ruby on Rails Ruby on Rails 0.13 Redmine Redmine 0.8.7 Redmine Redmine 0.8.6 Redmine Redmine 0.8.5 Redmine Redmine 0.7.3 Redmine Redmine 0.7.2 目前没有详细解决方案提供: http://www.rubyonrails.com/ http://www.redmine.org/ id SSV:15097 last seen 2017-11-19 modified 2009-12-17 published 2009-12-17 reporter Root source https://www.seebug.org/vuldb/ssvid-15097 title Ruby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞 bulletinFamily exploit description Bugraq ID: 37333 CVE ID:CVE-2009-4136 PostgreSQL是一款对象关系型数据库管理系统,支持扩展的SQL标准子集。 索引函数中处理会话状态更改存在一个错误,本地攻击者可以利用漏洞提升特权。 PostgreSQL PostgreSQL 8.4.1 PostgreSQL PostgreSQL 8.3.8 PostgreSQL PostgreSQL 8.3.6 PostgreSQL PostgreSQL 8.2.14 PostgreSQL PostgreSQL 8.2.6 PostgreSQL PostgreSQL 8.2.4 PostgreSQL PostgreSQL 8.2.3 PostgreSQL PostgreSQL 8.2.2 PostgreSQL PostgreSQL 8.2 PostgreSQL PostgreSQL 8.1.18 PostgreSQL PostgreSQL 8.1.11 PostgreSQL PostgreSQL 8.1.9 PostgreSQL PostgreSQL 8.1.8 PostgreSQL PostgreSQL 8.1.5 PostgreSQL PostgreSQL 8.1.4 PostgreSQL PostgreSQL 8.1.3 PostgreSQL PostgreSQL 8.1.1 PostgreSQL PostgreSQL 8.0.22 PostgreSQL PostgreSQL 8.0.15 PostgreSQL PostgreSQL 8.0.13 PostgreSQL PostgreSQL 8.0.9 PostgreSQL PostgreSQL 8.0.8 PostgreSQL PostgreSQL 8.0.7 PostgreSQL PostgreSQL 8.0.5 PostgreSQL PostgreSQL 8.0.4 PostgreSQL PostgreSQL 8.0.3 PostgreSQL PostgreSQL 8.0.2 PostgreSQL PostgreSQL 8.0.1 PostgreSQL PostgreSQL 8.0 PostgreSQL PostgreSQL 7.4.26 PostgreSQL PostgreSQL 7.4.19 PostgreSQL PostgreSQL 7.4.17 PostgreSQL PostgreSQL 7.4.14 PostgreSQL PostgreSQL 7.4.13 PostgreSQL PostgreSQL 7.4.12 PostgreSQL PostgreSQL 7.4.11 PostgreSQL PostgreSQL 7.4.10 PostgreSQL PostgreSQL 7.4.9 PostgreSQL PostgreSQL 7.4.8 PostgreSQL PostgreSQL 7.4.7 PostgreSQL PostgreSQL 7.4.6 PostgreSQL PostgreSQL 7.4.5 PostgreSQL PostgreSQL 7.4.4 PostgreSQL PostgreSQL 7.4.3 PostgreSQL PostgreSQL 7.4.2 PostgreSQL PostgreSQL 7.4.1 PostgreSQL PostgreSQL 7.4 PostgreSQL PostgreSQL 8.4 PostgreSQL PostgreSQL 8.3 PostgreSQL PostgreSQL 8.1.7 PostgreSQL PostgreSQL 8.0.11 PostgreSQL PostgreSQL 7.4.16 厂商解决方案 用户可参考如下安全公告获得补丁信息: http://www.postgresql.org/about/news.1170 id SSV:15095 last seen 2017-11-19 modified 2009-12-17 published 2009-12-17 reporter Root title PostgreSQL索引函数会话状态修改本地特权提升漏洞
Statements
contributor | Mark Cox |
lastmodified | 2010-05-20 |
organization | Red Hat |
statement | This issue was addressed in Red Hat Enterprise Linux 3 via https://rhn.redhat.com/errata/RHSA-2010-0427.html This issue was addressed in Red Hat Enterprise Linux 4 via https://rhn.redhat.com/errata/RHSA-2010-0428.html This issue was addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-0429.html and https://rhn.redhat.com/errata/RHSA-2010-0430.html |
References
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://osvdb.org/61039
- http://secunia.com/advisories/37663
- http://secunia.com/advisories/39820
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:333
- http://www.postgresql.org/docs/current/static/release-7-4-27.html
- http://www.postgresql.org/docs/current/static/release-8-0-23.html
- http://www.postgresql.org/docs/current/static/release-8-1-19.html
- http://www.postgresql.org/docs/current/static/release-8-2-15.html
- http://www.postgresql.org/docs/current/static/release-8-3-9.html
- http://www.postgresql.org/docs/current/static/release-8-4-2.html
- http://www.postgresql.org/support/security.html
- http://www.redhat.com/support/errata/RHSA-2010-0427.html
- http://www.redhat.com/support/errata/RHSA-2010-0428.html
- http://www.redhat.com/support/errata/RHSA-2010-0429.html
- http://www.securityfocus.com/archive/1/509917/100/0/threaded
- http://www.securityfocus.com/bid/37333
- http://www.securitytracker.com/id?1023326
- http://www.vupen.com/english/advisories/2009/3519
- http://www.vupen.com/english/advisories/2010/1197
- https://bugzilla.redhat.com/show_bug.cgi?id=546321
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9358
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01035.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01056.html