Vulnerabilities > CVE-2009-4136 - Local Privilege Escalation vulnerability in PostgreSQL Index Function Session State Modification

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
postgresql
nessus

Summary

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Vulnerable Configurations

Part Description Count
Application
Postgresql
92

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_2_POSTGRESQL-100111.NASL
    descriptionAn unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id44054
    published2010-01-19
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44054
    titleopenSUSE Security Update : postgresql (postgresql-1773)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update postgresql-1773.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(44054);
      script_version("1.8");
      script_cvs_date("Date: 2019/10/25 13:36:38");
    
      script_cve_id("CVE-2009-4034", "CVE-2009-4136");
    
      script_name(english:"openSUSE Security Update : postgresql (postgresql-1773)");
      script_summary(english:"Check for the postgresql-1773 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An unprivileged, authenticated PostgreSQL user could create a table
    which references functions with malicious content. Maintenance
    operations carried out be the database superuser could execute such
    functions (CVE-2009-4136).
    
    Embedded null bytes in the common name of SSL certificates could
    bypass certificate hostname checks (CVE-2009-4034).
    
    postgresql was updated to the next upstream patchlevel update which
    also includes several bugfixes. See the package changelog for details."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=564360"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=564710"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_cwe_id(310);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/01/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-contrib-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-devel-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-libs-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-plperl-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-plpython-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-pltcl-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", reference:"postgresql-server-8.4.2-1.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.2", cpu:"x86_64", reference:"postgresql-libs-32bit-8.4.2-1.1.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201110-22.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201110-22 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote authenticated attacker could send a specially crafted SQL query to a PostgreSQL server with the
    last seen2020-06-01
    modified2020-06-02
    plugin id56626
    published2011-10-25
    reporterThis script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/56626
    titleGLSA-201110-22 : PostgreSQL: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201110-22.
    #
    # The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(56626);
      script_version("1.12");
      script_cvs_date("Date: 2019/08/12 17:35:38");
    
      script_cve_id("CVE-2009-0922", "CVE-2009-3229", "CVE-2009-3230", "CVE-2009-3231", "CVE-2009-4034", "CVE-2009-4136", "CVE-2010-0442", "CVE-2010-0733", "CVE-2010-1169", "CVE-2010-1170", "CVE-2010-1447", "CVE-2010-1975", "CVE-2010-3433", "CVE-2010-4015", "CVE-2011-2483");
      script_bugtraq_id(34090, 36314, 37333, 37334, 37973, 38619, 40215, 40304, 40305, 43747, 46084, 49241);
      script_xref(name:"GLSA", value:"201110-22");
    
      script_name(english:"GLSA-201110-22 : PostgreSQL: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201110-22
    (PostgreSQL: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in PostgreSQL. Please
          review the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote authenticated attacker could send a specially crafted SQL query
          to a PostgreSQL server with the 'intarray' module enabled, possibly
          resulting in the execution of arbitrary code with the privileges of the
          PostgreSQL server process, or a Denial of Service condition. Furthermore,
          a remote authenticated attacker could execute arbitrary Perl code, cause
          a Denial of Service condition via different vectors, bypass LDAP
          authentication, bypass X.509 certificate validation, gain database
          privileges, exploit weak blowfish encryption and possibly cause other
          unspecified impact.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201110-22"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All PostgreSQL 8.2 users should upgrade to the latest 8.2 base version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-base-8.2.22:8.2'
        All PostgreSQL 8.3 users should upgrade to the latest 8.3 base version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-base-8.3.16:8.3'
        All PostgreSQL 8.4 users should upgrade to the latest 8.4 base version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-base-8.4.9:8.4'
        All PostgreSQL 9.0 users should upgrade to the latest 9.0 base version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-base-9.0.5:9.0'
        All PostgreSQL 8.2 server users should upgrade to the latest 8.2 server
          version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-server-8.2.22:8.2'
        All PostgreSQL 8.3 server users should upgrade to the latest 8.3 server
          version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-server-8.3.16:8.3'
        All PostgreSQL 8.4 server users should upgrade to the latest 8.4 server
          version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-server-8.4.9:8.4'
        All PostgreSQL 9.0 server users should upgrade to the latest 9.0 server
          version:
          # emerge --sync
          # emerge --ask --oneshot --verbose
          '>=dev-db/postgresql-server-9.0.5:9.0'
        The old unsplit PostgreSQL packages have been removed from portage.
          Users still using them are urged to migrate to the new PostgreSQL
          packages as stated above and to remove the old package:
          # emerge --unmerge 'dev-db/postgresql'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(189, 264, 287, 310, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2009/03/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/10/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/10/25");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-db/postgresql-server", unaffected:make_list("ge 9.0.5", "rge 8.4.9", "rge 8.3.16", "rge 8.2.22", "rge 8.4.10", "rge 8.3.17", "rge 8.2.23", "ge 8.4.11", "ge 8.3.18"), vulnerable:make_list("lt 9.0.5"))) flag++;
    if (qpkg_check(package:"dev-db/postgresql", unaffected:make_list(), vulnerable:make_list("le 9"))) flag++;
    if (qpkg_check(package:"dev-db/postgresql-base", unaffected:make_list("ge 9.0.5", "rge 8.4.9", "rge 8.3.16", "rge 8.2.22", "rge 8.4.10", "rge 8.3.17", "rge 8.2.23", "ge 8.4.11", "ge 8.3.18"), vulnerable:make_list("lt 9.0.5"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PostgreSQL");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0428.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/7.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id46696
    published2010-05-24
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46696
    titleCentOS 4 : postgresql (CESA-2010:0428)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2010:0428 and 
    # CentOS Errata and Security Advisory 2010:0428 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(46696);
      script_version("1.16");
      script_cvs_date("Date: 2019/10/25 13:36:05");
    
      script_cve_id("CVE-2009-4136", "CVE-2010-0442", "CVE-2010-0733", "CVE-2010-1168", "CVE-2010-1169", "CVE-2010-1170", "CVE-2010-1447", "CVE-2010-1975");
      script_xref(name:"RHSA", value:"2010:0428");
    
      script_name(english:"CentOS 4 : postgresql (CESA-2010:0428)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated postgresql packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 4.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    PostgreSQL is an advanced object-relational database management system
    (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions
    in the Perl and Tcl languages, and are installed in trusted mode by
    default. In trusted mode, certain operations, such as operating system
    level access, are restricted.
    
    A flaw was found in the way PostgreSQL enforced permission checks on
    scripts written in PL/Perl. If the PL/Perl procedural language was
    registered on a particular database, an authenticated database user
    running a specially crafted PL/Perl script could use this flaw to
    bypass intended PL/Perl trusted mode restrictions, allowing them to
    run arbitrary Perl scripts with the privileges of the database server.
    (CVE-2010-1169)
    
    Red Hat would like to thank Tim Bunce for responsibly reporting the
    CVE-2010-1169 flaw.
    
    A flaw was found in the way PostgreSQL enforced permission checks on
    scripts written in PL/Tcl. If the PL/Tcl procedural language was
    registered on a particular database, an authenticated database user
    running a specially crafted PL/Tcl script could use this flaw to
    bypass intended PL/Tcl trusted mode restrictions, allowing them to run
    arbitrary Tcl scripts with the privileges of the database server.
    (CVE-2010-1170)
    
    A buffer overflow flaw was found in the way PostgreSQL retrieved a
    substring from the bit string for BIT() and BIT VARYING() SQL data
    types. An authenticated database user running a specially crafted SQL
    query could use this flaw to cause a temporary denial of service
    (postgres daemon crash) or, potentially, execute arbitrary code with
    the privileges of the database server. (CVE-2010-0442)
    
    An integer overflow flaw was found in the way PostgreSQL used to
    calculate the size of the hash table for joined relations. An
    authenticated database user could create a specially crafted SQL query
    which could cause a temporary denial of service (postgres daemon
    crash) or, potentially, execute arbitrary code with the privileges of
    the database server. (CVE-2010-0733)
    
    PostgreSQL improperly protected session-local state during the
    execution of an index function by a database superuser during the
    database maintenance operations. An authenticated database user could
    use this flaw to elevate their privileges via specially crafted index
    functions. (CVE-2009-4136)
    
    These packages upgrade PostgreSQL to version 7.4.29. Refer to the
    PostgreSQL Release Notes for a list of changes :
    
    http://www.postgresql.org/docs/7.4/static/release.html
    
    All PostgreSQL users are advised to upgrade to these updated packages,
    which correct these issues. If the postgresql service is running, it
    will be automatically restarted after installing this update."
      );
      # https://lists.centos.org/pipermail/centos-announce/2010-May/016645.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?669521f0"
      );
      # https://lists.centos.org/pipermail/centos-announce/2010-May/016646.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?369bfc61"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_cwe_id(189);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-jdbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-pl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-tcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:4");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2009/12/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/05/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/05/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 4.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-contrib-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-contrib-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-devel-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-devel-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-docs-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-docs-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-jdbc-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-jdbc-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-libs-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-libs-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-pl-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-pl-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-python-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-python-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-server-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-server-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-tcl-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-tcl-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"i386", reference:"postgresql-test-7.4.29-1.el4_8.1")) flag++;
    if (rpm_check(release:"CentOS-4", cpu:"x86_64", reference:"postgresql-test-7.4.29-1.el4_8.1")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_POSTGRESQL-100108.NASL
    descriptionAn unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id44052
    published2010-01-19
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44052
    titleopenSUSE Security Update : postgresql (postgresql-1773)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update postgresql-1773.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(44052);
      script_version("1.8");
      script_cvs_date("Date: 2019/10/25 13:36:38");
    
      script_cve_id("CVE-2009-4034", "CVE-2009-4136");
    
      script_name(english:"openSUSE Security Update : postgresql (postgresql-1773)");
      script_summary(english:"Check for the postgresql-1773 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An unprivileged, authenticated PostgreSQL user could create a table
    which references functions with malicious content. Maintenance
    operations carried out be the database superuser could execute such
    functions (CVE-2009-4136).
    
    Embedded null bytes in the common name of SSL certificates could
    bypass certificate hostname checks (CVE-2009-4034).
    
    postgresql was updated to the next upstream patchlevel update which
    also includes several bugfixes. See the package changelog for details."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=564360"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=564710"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_cwe_id(310);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/01/08");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/19");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-contrib-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-devel-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-libs-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-plperl-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-plpython-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-pltcl-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", reference:"postgresql-server-8.3.9-0.1.1") ) flag++;
    if ( rpm_check(release:"SUSE11.1", cpu:"x86_64", reference:"postgresql-libs-32bit-8.3.9-0.1.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0427.NASL
    descriptionFrom Red Hat Security Advisory 2010:0427 : Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Running PostgreSQL instances must be restarted (
    last seen2020-06-01
    modified2020-06-02
    plugin id68042
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68042
    titleOracle Linux 3 : postgresql (ELSA-2010-0427)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0427.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Running PostgreSQL instances must be restarted (
    last seen2020-06-01
    modified2020-06-02
    plugin id46681
    published2010-05-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46681
    titleRHEL 3 : postgresql (RHSA-2010:0427)
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_12571.NASL
    descriptionThe following bugs have been fixed : - An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) - Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id44050
    published2010-01-19
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44050
    titleSuSE9 Security Update : PostgreSQL (YOU Patch Number 12571)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0429.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 8.1.21. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/8.1/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id46761
    published2010-06-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46761
    titleCentOS 5 : postgresql (CESA-2010:0429)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0429.NASL
    descriptionFrom Red Hat Security Advisory 2010:0429 : Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 8.1.21. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/8.1/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id68044
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68044
    titleOracle Linux 5 : postgresql (ELSA-2010-0429)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-13381.NASL
    descriptionUpdate to latest upstream point releases Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id43340
    published2009-12-18
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/43340
    titleFedora 12 : postgresql-8.4.2-1.fc12 (2009-13381)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_POSTGRESQL-6768.NASL
    descriptionThe following bugs have been fixed : An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id49920
    published2010-10-11
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49920
    titleSuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6768)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_POSTGRESQL-100111.NASL
    descriptionThe following bugs have been fixed : - An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) - Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id52689
    published2011-03-17
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/52689
    titleSuSE 11 Security Update : PostgreSQL (SAT Patch Number 1766)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_POSTGRESQL-6767.NASL
    descriptionThe following bugs have been fixed : An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id44056
    published2010-01-19
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44056
    titleSuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6767)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0429.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 8.1.21. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/8.1/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id46683
    published2010-05-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46683
    titleRHEL 5 : postgresql (RHSA-2010:0429)
  • NASL familyDatabases
    NASL idPOSTGRESQL_20091214.NASL
    descriptionThe version of PostgreSQL installed on the remote host is 7.4 prior to 7.4.27, 8.0 prior to 8.0.23, 8.1 prior to 8.1.19, 8.2 prior to 8.2.15, 8.3 prior to 8.3.9 or 8.4 prior to 8.4.2. As such, it is potentially affected by multiple vulnerabilities : - NULL bytes in SSL Certificates can be used to falsify client or server authentication. (CVE-2009-4034) - Privilege escalation is possible via changing session state in an index function. (CVE-2009-4136)
    last seen2020-06-01
    modified2020-06-02
    plugin id63348
    published2012-12-28
    reporterThis script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63348
    titlePostgreSQL 7.4 < 7.4.27 / 8.0 < 8.0.23 / 8.1 < 8.1.19 / 8.2 < 8.2.15 / 8.3 < 8.3.9 / 8.4 < 8.4.2 Multiple Vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0428.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/7.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id46682
    published2010-05-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46682
    titleRHEL 4 : postgresql (RHSA-2010:0428)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_POSTGRESQL-100108.NASL
    descriptionThe following bugs have been fixed : - An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. (CVE-2009-4136) - Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks. (CVE-2009-4034) PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id44055
    published2010-01-19
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44055
    titleSuSE 11 Security Update : PostgreSQL (SAT Patch Number 1766)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_POSTGRESQL-100108.NASL
    descriptionAn unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions (CVE-2009-4136). Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks (CVE-2009-4034). postgresql was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
    last seen2020-06-01
    modified2020-06-02
    plugin id44051
    published2010-01-19
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/44051
    titleopenSUSE Security Update : postgresql (postgresql-1773)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_E7BC5600EAA011DEBD9C00215C6A37BB.NASL
    descriptionPostgreSQL project reports : PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a
    last seen2020-06-01
    modified2020-06-02
    plugin id43177
    published2009-12-17
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43177
    titleFreeBSD : postgresql -- multiple vulnerabilities (e7bc5600-eaa0-11de-bd9c-00215c6a37bb)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0428.NASL
    descriptionFrom Red Hat Security Advisory 2010:0428 : Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes : http://www.postgresql.org/docs/7.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id68043
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68043
    titleOracle Linux 4 : postgresql (ELSA-2010-0428)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20100519_POSTGRESQL_ON_SL3_X.NASL
    descriptionPostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id60795
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60795
    titleScientific Linux Security Update : postgresql on SL3.x, SL4.x, SL5.x i386/x86_64
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0427.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server. (CVE-2010-1169) Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw. A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server. (CVE-2010-1170) A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442) An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733) PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Running PostgreSQL instances must be restarted (
    last seen2020-06-01
    modified2020-06-02
    plugin id46695
    published2010-05-24
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46695
    titleCentOS 3 : postgresql (CESA-2010:0427)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2009-13363.NASL
    descriptionUpdate to latest upstream point releases Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id43337
    published2009-12-18
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/43337
    titleFedora 11 : postgresql-8.3.9-1.fc11 (2009-13363)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-876-1.NASL
    descriptionIt was discovered that PostgreSQL did not properly handle certificates with NULL characters in the Common Name field of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2009-4034) It was discovered that PostgreSQL did not properly manage session-local state. A remote authenticated user could exploit this to escalate priviliges within PostgreSQL. (CVE-2009-4136). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id43622
    published2010-01-04
    reporterUbuntu Security Notice (C) 2010-2019 Canonical, Inc. / NASL script (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/43622
    titleUbuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerabilities (USN-876-1)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2009-333.NASL
    descriptionMultiple vulnerabilities was discovered and corrected in postgresql : NULL Bytes in SSL Certificates can be used to falsify client or server authentication. This only affects users who have SSL enabled, perform certificate name validation or client certificate authentication, and where the Certificate Authority (CA) has been tricked into issuing invalid certificates. The use of a CA that can be trusted to always issue valid certificates is recommended to ensure you are not vulnerable to this issue (CVE-2009-4034). Privilege escalation via changing session state in an index function. This closes a corner case related to vulnerabilities CVE-2009-3230 and CVE-2007-6600 (CVE-2009-4136). Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations (CVE-2010-0733). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers This update provides a solution to these vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id43167
    published2009-12-16
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/43167
    titleMandriva Linux Security Advisory : postgresql (MDVSA-2009:333)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1964.NASL
    descriptionSeveral vulnerabilities have been discovered in PostgreSQL, a database server. The Common Vulnerabilities and Exposures project identifies the following problems : It was discovered that PostgreSQL did not properly verify the Common Name attribute in X.509 certificates, enabling attackers to bypass the (optional) TLS protection on client-server connections, by relying on a certificate from a trusted CA which contains an embedded NUL byte in the Common Name (CVE-2009-4034 ). Authenticated database users could elevate their privileges by creating specially crafted index functions (CVE-2009-4136 ). The following matrix shows fixed source package versions for the respective distributions. oldstable/etch stable/lenny testing/unstable postgresql-7.4 7.4.27-0etch1 postgresql-8.1 8.1.19-0etch1 postgresql-8.3 8.3.9-0lenny1 8.3.9-1 postgresql-8.4 8.4.2-1 In addition to these security fixes, the updates contain reliability improvements and fix other defects.
    last seen2020-06-01
    modified2020-06-02
    plugin id44829
    published2010-02-24
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/44829
    titleDebian DSA-1964-1 : postgresql-7.4, postgresql-8.1, postgresql-8.3 - several vulnerabilities

Oval

accepted2013-04-29T04:18:56.517-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
    ovaloval:org.mitre.oval:def:11782
  • commentCentOS Linux 3.x
    ovaloval:org.mitre.oval:def:16651
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
    ovaloval:org.mitre.oval:def:11831
  • commentCentOS Linux 4.x
    ovaloval:org.mitre.oval:def:16636
  • commentOracle Linux 4.x
    ovaloval:org.mitre.oval:def:15990
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
    ovaloval:org.mitre.oval:def:11414
  • commentThe operating system installed on the system is CentOS Linux 5.x
    ovaloval:org.mitre.oval:def:15802
  • commentOracle Linux 5.x
    ovaloval:org.mitre.oval:def:15459
descriptionPostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
familyunix
idoval:org.mitre.oval:def:9358
statusaccepted
submitted2010-07-09T03:56:16-04:00
titlePostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
version27

Redhat

advisories
  • rhsa
    idRHSA-2010:0427
  • rhsa
    idRHSA-2010:0428
  • rhsa
    idRHSA-2010:0429
rpms
  • rh-postgresql-0:7.3.21-3
  • rh-postgresql-contrib-0:7.3.21-3
  • rh-postgresql-debuginfo-0:7.3.21-3
  • rh-postgresql-devel-0:7.3.21-3
  • rh-postgresql-docs-0:7.3.21-3
  • rh-postgresql-jdbc-0:7.3.21-3
  • rh-postgresql-libs-0:7.3.21-3
  • rh-postgresql-pl-0:7.3.21-3
  • rh-postgresql-python-0:7.3.21-3
  • rh-postgresql-server-0:7.3.21-3
  • rh-postgresql-tcl-0:7.3.21-3
  • rh-postgresql-test-0:7.3.21-3
  • postgresql-0:7.4.29-1.el4_8.1
  • postgresql-contrib-0:7.4.29-1.el4_8.1
  • postgresql-debuginfo-0:7.4.29-1.el4_8.1
  • postgresql-devel-0:7.4.29-1.el4_8.1
  • postgresql-docs-0:7.4.29-1.el4_8.1
  • postgresql-jdbc-0:7.4.29-1.el4_8.1
  • postgresql-libs-0:7.4.29-1.el4_8.1
  • postgresql-pl-0:7.4.29-1.el4_8.1
  • postgresql-python-0:7.4.29-1.el4_8.1
  • postgresql-server-0:7.4.29-1.el4_8.1
  • postgresql-tcl-0:7.4.29-1.el4_8.1
  • postgresql-test-0:7.4.29-1.el4_8.1
  • postgresql-0:8.1.21-1.el5_5.1
  • postgresql-contrib-0:8.1.21-1.el5_5.1
  • postgresql-debuginfo-0:8.1.21-1.el5_5.1
  • postgresql-devel-0:8.1.21-1.el5_5.1
  • postgresql-docs-0:8.1.21-1.el5_5.1
  • postgresql-libs-0:8.1.21-1.el5_5.1
  • postgresql-pl-0:8.1.21-1.el5_5.1
  • postgresql-python-0:8.1.21-1.el5_5.1
  • postgresql-server-0:8.1.21-1.el5_5.1
  • postgresql-tcl-0:8.1.21-1.el5_5.1
  • postgresql-test-0:8.1.21-1.el5_5.1

Seebug

  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 37333 CVE ID: CVE-2009-4136 PostgreSQL是一款高级对象-关系型数据库管理系统,支持扩展的SQL标准子集。 PostgreSQL在执行数据库超级用户的索引功能期间没有正确地管理session-local状态,这允许通过认证的远程攻击者通过带有特制索引功能的表格获得权限提升。 PostgreSQL PostgreSQL 8.4.x PostgreSQL PostgreSQL 8.3.x PostgreSQL PostgreSQL 8.2.x PostgreSQL PostgreSQL 8.1.x PostgreSQL PostgreSQL 8.0.x PostgreSQL PostgreSQL 7.4.x 厂商补丁: PostgreSQL ---------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.postgresql.org/about/news.1170 Sun --- Sun已经为此发布了一个安全公告(Sun-Alert-6909139)以及相应补丁: Sun-Alert-6909139:Security Vulnerabilities in PostgreSQL Shipped With Solaris May Allow Escalation of Privileges or Man-in-the-Middle on SSL Connections 链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-274870-1
    idSSV:15153
    last seen2017-11-19
    modified2009-12-29
    published2009-12-29
    reporterRoot
    titlePostgreSQL索引功能权限提升漏洞
  • bulletinFamilyexploit
    descriptionBugraq ID: 37322 CVE ID:CVE-2009-4136 Ruby on Rails是一款Web应用程序框架,构建在Ruby语言之上。 Ruby on Rails 'protect_from_forgery'存在跨站请求伪造攻击,远程攻击者可以利用漏洞执行部分管理员操作,获得对应用程序的未授权访问或删除部分数据。 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails 2.3.2 Ruby on Rails Ruby on Rails 2.2.3 Ruby on Rails Ruby on Rails 2.2.2 Ruby on Rails Ruby on Rails 2.1.1 Ruby on Rails Ruby on Rails 2.1 Ruby on Rails Ruby on Rails 2.0.5 Ruby on Rails Ruby on Rails 2.0.4 Ruby on Rails Ruby on Rails 2.0 Ruby on Rails Ruby on Rails 1.2.6 Ruby on Rails Ruby on Rails 1.2.5 Ruby on Rails Ruby on Rails 1.2.3 Ruby on Rails Ruby on Rails 1.1.6 Ruby on Rails Ruby on Rails 1.1.5 Ruby on Rails Ruby on Rails 1.1.4 Ruby on Rails Ruby on Rails 1.1.3 Ruby on Rails Ruby on Rails 1.1.2 Ruby on Rails Ruby on Rails 1.1.1 Ruby on Rails Ruby on Rails 1.1 Ruby on Rails Ruby on Rails 1.0 Ruby on Rails Ruby on Rails 0.14 Ruby on Rails Ruby on Rails 0.13 Redmine Redmine 0.8.7 Redmine Redmine 0.8.6 Redmine Redmine 0.8.5 Redmine Redmine 0.7.3 Redmine Redmine 0.7.2 目前没有详细解决方案提供: http://www.rubyonrails.com/ http://www.redmine.org/
    idSSV:15097
    last seen2017-11-19
    modified2009-12-17
    published2009-12-17
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-15097
    titleRuby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞
  • bulletinFamilyexploit
    descriptionBugraq ID: 37333 CVE ID:CVE-2009-4136 PostgreSQL是一款对象关系型数据库管理系统,支持扩展的SQL标准子集。 索引函数中处理会话状态更改存在一个错误,本地攻击者可以利用漏洞提升特权。 PostgreSQL PostgreSQL 8.4.1 PostgreSQL PostgreSQL 8.3.8 PostgreSQL PostgreSQL 8.3.6 PostgreSQL PostgreSQL 8.2.14 PostgreSQL PostgreSQL 8.2.6 PostgreSQL PostgreSQL 8.2.4 PostgreSQL PostgreSQL 8.2.3 PostgreSQL PostgreSQL 8.2.2 PostgreSQL PostgreSQL 8.2 PostgreSQL PostgreSQL 8.1.18 PostgreSQL PostgreSQL 8.1.11 PostgreSQL PostgreSQL 8.1.9 PostgreSQL PostgreSQL 8.1.8 PostgreSQL PostgreSQL 8.1.5 PostgreSQL PostgreSQL 8.1.4 PostgreSQL PostgreSQL 8.1.3 PostgreSQL PostgreSQL 8.1.1 PostgreSQL PostgreSQL 8.0.22 PostgreSQL PostgreSQL 8.0.15 PostgreSQL PostgreSQL 8.0.13 PostgreSQL PostgreSQL 8.0.9 PostgreSQL PostgreSQL 8.0.8 PostgreSQL PostgreSQL 8.0.7 PostgreSQL PostgreSQL 8.0.5 PostgreSQL PostgreSQL 8.0.4 PostgreSQL PostgreSQL 8.0.3 PostgreSQL PostgreSQL 8.0.2 PostgreSQL PostgreSQL 8.0.1 PostgreSQL PostgreSQL 8.0 PostgreSQL PostgreSQL 7.4.26 PostgreSQL PostgreSQL 7.4.19 PostgreSQL PostgreSQL 7.4.17 PostgreSQL PostgreSQL 7.4.14 PostgreSQL PostgreSQL 7.4.13 PostgreSQL PostgreSQL 7.4.12 PostgreSQL PostgreSQL 7.4.11 PostgreSQL PostgreSQL 7.4.10 PostgreSQL PostgreSQL 7.4.9 PostgreSQL PostgreSQL 7.4.8 PostgreSQL PostgreSQL 7.4.7 PostgreSQL PostgreSQL 7.4.6 PostgreSQL PostgreSQL 7.4.5 PostgreSQL PostgreSQL 7.4.4 PostgreSQL PostgreSQL 7.4.3 PostgreSQL PostgreSQL 7.4.2 PostgreSQL PostgreSQL 7.4.1 PostgreSQL PostgreSQL 7.4 PostgreSQL PostgreSQL 8.4 PostgreSQL PostgreSQL 8.3 PostgreSQL PostgreSQL 8.1.7 PostgreSQL PostgreSQL 8.0.11 PostgreSQL PostgreSQL 7.4.16 厂商解决方案 用户可参考如下安全公告获得补丁信息: http://www.postgresql.org/about/news.1170
    idSSV:15095
    last seen2017-11-19
    modified2009-12-17
    published2009-12-17
    reporterRoot
    titlePostgreSQL索引函数会话状态修改本地特权提升漏洞

Statements

contributorMark Cox
lastmodified2010-05-20
organizationRed Hat
statementThis issue was addressed in Red Hat Enterprise Linux 3 via https://rhn.redhat.com/errata/RHSA-2010-0427.html This issue was addressed in Red Hat Enterprise Linux 4 via https://rhn.redhat.com/errata/RHSA-2010-0428.html This issue was addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-0429.html and https://rhn.redhat.com/errata/RHSA-2010-0430.html

References