Vulnerabilities > CVE-2012-2655 - Resource Management Errors vulnerability in Postgresql

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
postgresql
CWE-399
nessus

Summary

PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2012-94.NASL
    descriptionA flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143) Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated. A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language
    last seen2020-06-01
    modified2020-06-02
    plugin id69701
    published2013-09-04
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69701
    titleAmazon Linux AMI : postgresql8 (ALAS-2012-94)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2012-94.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(69701);
      script_version("1.5");
      script_cvs_date("Date: 2018/04/18 15:09:34");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2655");
      script_xref(name:"ALAS", value:"2012-94");
      script_xref(name:"RHSA", value:"2012:1037");
    
      script_name(english:"Amazon Linux AMI : postgresql8 (ALAS-2012-94)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A flaw was found in the way the crypt() password hashing function from
    the optional PostgreSQL pgcrypto contrib module performed password
    transformation when used with the DES algorithm. If the password
    string to be hashed contained the 0x80 byte value, the remainder of
    the string was ignored when calculating the hash, significantly
    reducing the password strength. This made brute-force guessing more
    efficient as the whole password was not required to gain access to
    protected resources. (CVE-2012-2143)
    
    Note: With this update, the rest of the string is properly included in
    the DES hash; therefore, any previously stored password values that
    are affected by this issue will no longer match. In such cases, it
    will be necessary for those stored password hashes to be updated.
    
    A denial of service flaw was found in the way the PostgreSQL server
    performed a user privileges check when applying SECURITY DEFINER or
    SET attributes to a procedural language's (such as PL/Perl or
    PL/Python) call handler function. A non-superuser database owner could
    use this flaw to cause the PostgreSQL server to crash due to infinite
    recursion. (CVE-2012-2655)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2012-94.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update postgresql8' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/07/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/09/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"postgresql8-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-contrib-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-debuginfo-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-devel-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-docs-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-libs-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-plperl-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-plpython-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-pltcl-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-server-8.4.12-1.35.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-test-8.4.12-1.35.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql8 / postgresql8-contrib / postgresql8-debuginfo / etc");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-1037.NASL
    descriptionFrom Red Hat Security Advisory 2012:1037 : Updated postgresql84 and postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143) Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated. A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language
    last seen2020-06-01
    modified2020-06-02
    plugin id68568
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68568
    titleOracle Linux 5 / 6 : postgresql / postgresql84 (ELSA-2012-1037)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2012:1037 and 
    # Oracle Linux Security Advisory ELSA-2012-1037 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(68568);
      script_version("1.7");
      script_cvs_date("Date: 2019/09/30 10:58:17");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2655");
      script_bugtraq_id(52188, 53729, 53812);
      script_xref(name:"RHSA", value:"2012:1037");
    
      script_name(english:"Oracle Linux 5 / 6 : postgresql / postgresql84 (ELSA-2012-1037)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2012:1037 :
    
    Updated postgresql84 and postgresql packages that fix two security
    issues are now available for Red Hat Enterprise Linux 5 and 6
    respectively.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    PostgreSQL is an advanced object-relational database management system
    (DBMS).
    
    A flaw was found in the way the crypt() password hashing function from
    the optional PostgreSQL pgcrypto contrib module performed password
    transformation when used with the DES algorithm. If the password
    string to be hashed contained the 0x80 byte value, the remainder of
    the string was ignored when calculating the hash, significantly
    reducing the password strength. This made brute-force guessing more
    efficient as the whole password was not required to gain access to
    protected resources. (CVE-2012-2143)
    
    Note: With this update, the rest of the string is properly included in
    the DES hash; therefore, any previously stored password values that
    are affected by this issue will no longer match. In such cases, it
    will be necessary for those stored password hashes to be updated.
    
    A denial of service flaw was found in the way the PostgreSQL server
    performed a user privileges check when applying SECURITY DEFINER or
    SET attributes to a procedural language's (such as PL/Perl or
    PL/Python) call handler function. A non-superuser database owner could
    use this flaw to cause the PostgreSQL server to crash due to infinite
    recursion. (CVE-2012-2655)
    
    Upstream acknowledges Rubin Xu and Joseph Bonneau as the original
    reporters of the CVE-2012-2143 issue.
    
    These updated packages upgrade PostgreSQL to version 8.4.12, which
    fixes these issues as well as several non-security issues. Refer to
    the PostgreSQL Release Notes for a full list of changes :
    
    http://www.postgresql.org/docs/8.4/static/release.html
    
    All PostgreSQL users are advised to upgrade to these updated packages,
    which correct these issues. If the postgresql service is running, it
    will be automatically restarted after installing this update."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2012-June/002877.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2012-June/002893.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql and / or postgresql84 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-tcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql84-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5 / 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL5", reference:"postgresql84-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-contrib-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-devel-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-docs-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-libs-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-plperl-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-plpython-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-pltcl-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-python-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-server-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-tcl-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"EL5", reference:"postgresql84-test-8.4.12-1.el5_8")) flag++;
    
    if (rpm_check(release:"EL6", reference:"postgresql-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-contrib-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-devel-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-docs-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-libs-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-plperl-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-plpython-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-pltcl-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-server-8.4.12-1.el6_2")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-test-8.4.12-1.el6_2")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1037.NASL
    descriptionUpdated postgresql84 and postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143) Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated. A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language
    last seen2020-06-01
    modified2020-06-02
    plugin id59712
    published2012-06-26
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59712
    titleRHEL 5 / 6 : postgresql and postgresql84 (RHSA-2012:1037)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2012:1037. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59712);
      script_version ("1.21");
      script_cvs_date("Date: 2019/10/24 15:35:35");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2655");
      script_bugtraq_id(53729, 53812);
      script_xref(name:"RHSA", value:"2012:1037");
    
      script_name(english:"RHEL 5 / 6 : postgresql and postgresql84 (RHSA-2012:1037)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated postgresql84 and postgresql packages that fix two security
    issues are now available for Red Hat Enterprise Linux 5 and 6
    respectively.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    PostgreSQL is an advanced object-relational database management system
    (DBMS).
    
    A flaw was found in the way the crypt() password hashing function from
    the optional PostgreSQL pgcrypto contrib module performed password
    transformation when used with the DES algorithm. If the password
    string to be hashed contained the 0x80 byte value, the remainder of
    the string was ignored when calculating the hash, significantly
    reducing the password strength. This made brute-force guessing more
    efficient as the whole password was not required to gain access to
    protected resources. (CVE-2012-2143)
    
    Note: With this update, the rest of the string is properly included in
    the DES hash; therefore, any previously stored password values that
    are affected by this issue will no longer match. In such cases, it
    will be necessary for those stored password hashes to be updated.
    
    A denial of service flaw was found in the way the PostgreSQL server
    performed a user privileges check when applying SECURITY DEFINER or
    SET attributes to a procedural language's (such as PL/Perl or
    PL/Python) call handler function. A non-superuser database owner could
    use this flaw to cause the PostgreSQL server to crash due to infinite
    recursion. (CVE-2012-2655)
    
    Upstream acknowledges Rubin Xu and Joseph Bonneau as the original
    reporters of the CVE-2012-2143 issue.
    
    These updated packages upgrade PostgreSQL to version 8.4.12, which
    fixes these issues as well as several non-security issues. Refer to
    the PostgreSQL Release Notes for a full list of changes :
    
    http://www.postgresql.org/docs/8.4/static/release.html
    
    All PostgreSQL users are advised to upgrade to these updated packages,
    which correct these issues. If the postgresql service is running, it
    will be automatically restarted after installing this update."
      );
      # http://www.postgresql.org/docs/8.4/static/release.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/8.4/release.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2012:1037"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-2143"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-2655"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-tcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql84-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/26");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x / 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2012:1037";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-contrib-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-contrib-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-contrib-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", reference:"postgresql84-debuginfo-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", reference:"postgresql84-devel-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-docs-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-docs-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-docs-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", reference:"postgresql84-libs-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-plperl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-plperl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-plperl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-plpython-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-plpython-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-plpython-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-pltcl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-pltcl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-pltcl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-python-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-python-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-python-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-server-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-server-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-server-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-tcl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-tcl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-tcl-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"postgresql84-test-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"postgresql84-test-8.4.12-1.el5_8")) flag++;
    
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"postgresql84-test-8.4.12-1.el5_8")) flag++;
    
    
      if (rpm_check(release:"RHEL6", reference:"postgresql-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-contrib-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-contrib-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-contrib-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"postgresql-debuginfo-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"postgresql-devel-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-docs-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-docs-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-docs-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"postgresql-libs-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-plperl-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-plperl-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-plperl-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-plpython-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-plpython-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-plpython-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-pltcl-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-pltcl-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-pltcl-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-server-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-server-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-server-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-test-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-test-8.4.12-1.el6_2")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-test-8.4.12-1.el6_2")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_WARNING,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-debuginfo / etc");
      }
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_POSTGRESQL-120820.NASL
    descriptionThis update provides PostgreSQL 8.3.20. As part of this update, the packaging scheme has been changed to accomodate an optional parallel installation of newer PostgreSQL versions. The changes in 8.3.20 are : - Prevent access to external files/URLs via XML entity references. xml_parse() would attempt to fetch external files or URLs as needed to resolve DTD and entity references in an XML value, thus allowing unprivileged database users to attempt to fetch data with the privileges of the database server. (CVE-2012-3489, bnc#776524) - Prevent access to external files/URLs via
    last seen2020-06-05
    modified2013-01-25
    plugin id64216
    published2013-01-25
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64216
    titleSuSE 11.1 Security Update : PostgreSQL (SAT Patch Number 6697)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64216);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2655", "CVE-2012-3488", "CVE-2012-3489");
    
      script_name(english:"SuSE 11.1 Security Update : PostgreSQL (SAT Patch Number 6697)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update provides PostgreSQL 8.3.20. As part of this update, the
    packaging scheme has been changed to accomodate an optional parallel
    installation of newer PostgreSQL versions.
    
    The changes in 8.3.20 are :
    
      - Prevent access to external files/URLs via XML entity
        references. xml_parse() would attempt to fetch external
        files or URLs as needed to resolve DTD and entity
        references in an XML value, thus allowing unprivileged
        database users to attempt to fetch data with the
        privileges of the database server. (CVE-2012-3489,
        bnc#776524)
    
      - Prevent access to external files/URLs via
        'contrib/xml2''s xslt_process(). libxslt offers the
        ability to read and write both files and URLs through
        stylesheet commands, thus allowing unprivileged database
        users to both read and write data with the privileges of
        the database server. Disable that through proper use of
        libxslt's security options. (CVE-2012-3488, bnc#776523).
        Also, remove xslt_process()'s ability to fetch documents
        and stylesheets from external files/URLs.
    
      - Fix incorrect password transformation in
        contrib/pgcrypto's DES crypt() function. If a password
        string contained the byte value 0x80, the remainder of
        the password was ignored, causing the password to be
        much weaker than it appeared. With this fix, the rest of
        the string is properly included in the DES hash. Any
        stored password values that are affected by this bug
        will thus no longer match, so the stored values may need
        to be updated. (CVE-2012-2143)
    
      - Ignore SECURITY DEFINER and SET attributes for a
        procedural language's call handler. Applying such
        attributes to a call handler could crash the server.
        (CVE-2012-2655)
    
      - Allow numeric timezone offsets in timestamp input to be
        up to 16 hours away from UTC. Some historical time zones
        have offsets larger than 15 hours, the previous limit.
        This could result in dumped data values being rejected
        during reload.
    
      - Fix timestamp conversion to cope when the given time is
        exactly the last DST transition time for the current
        timezone. This oversight has been there a long time, but
        was not noticed previously because most DST-using zones
        are presumed to have an indefinite sequence of future
        DST transitions.
    
      - Fix text to name and char to name casts to perform
        string truncation correctly in multibyte encodings.
    
      - Fix memory copying bug in to_tsquery().
    
      - Fix slow session startup when pg_attribute is very
        large. If pg_attribute exceeds one-fourth of
        shared_buffers, cache rebuilding code that is sometimes
        needed during session start would trigger the
        synchronized-scan logic, causing it to take many times
        longer than normal. The problem was particularly acute
        if many new sessions were starting at once.
    
      - Ensure sequential scans check for query cancel
        reasonably often. A scan encountering many consecutive
        pages that contain no live tuples would not respond to
        interrupts meanwhile.
    
      - Show whole-row variables safely when printing views or
        rules. Corner cases involving ambiguous names (that is,
        the name could be either a table or column name of the
        query) were printed in an ambiguous way, risking that
        the view or rule would be interpreted differently after
        dump and reload. Avoid the ambiguous case by attaching a
        no-op cast.
    
      - Ensure autovacuum worker processes perform stack depth
        checking properly. Previously, infinite recursion in a
        function invoked by auto-ANALYZE could crash worker
        processes.
    
      - Fix logging collector to not lose log coherency under
        high load. The collector previously could fail to
        reassemble large messages if it got too busy.
    
      - Fix logging collector to ensure it will restart file
        rotation after receiving SIGHUP.
    
      - Fix PL/pgSQL's GET DIAGNOSTICS command when the target
        is the function's first variable.
    
      - Fix several performance problems in pg_dump when the
        database contains many objects. pg_dump could get very
        slow if the database contained many schemas, or if many
        objects are in dependency loops, or if there are many
        owned sequences.
    
      - Fix contrib/dblink's dblink_exec() to not leak temporary
        database connections upon error."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=760511"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=765069"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=766799"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=767505"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=770193"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=773771"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=774616"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=774617"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=775399"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=775402"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=776523"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=776524"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-2143.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-2655.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3488.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3489.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 6697.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:postgresql-init");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/20");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"postgresql-8.3.20-0.4.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"postgresql-init-9.1-0.6.10.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"postgresql-8.3.20-0.4.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"postgresql-init-9.1-0.6.10.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"postgresql-8.3.20-0.4.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"postgresql-contrib-8.3.20-0.4.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"postgresql-docs-8.3.20-0.4.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"postgresql-init-9.1-0.6.10.1")) flag++;
    if (rpm_check(release:"SLES11", sp:1, reference:"postgresql-server-8.3.20-0.4.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-092.NASL
    descriptionMultiple vulnerabilities has been discovered and corrected in postgresql : Fix incorrect password transformation in contrib/pgcrypto
    last seen2020-06-01
    modified2020-06-02
    plugin id59518
    published2012-06-15
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59518
    titleMandriva Linux Security Advisory : postgresql (MDVSA-2012:092)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandriva Linux Security Advisory MDVSA-2012:092. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59518);
      script_version("1.14");
      script_cvs_date("Date: 2019/08/02 13:32:54");
    
      script_cve_id("CVE-2012-0866", "CVE-2012-2143", "CVE-2012-2655");
      script_bugtraq_id(53729, 53812);
      script_xref(name:"MDVSA", value:"2012:092");
    
      script_name(english:"Mandriva Linux Security Advisory : postgresql (MDVSA-2012:092)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandriva Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple vulnerabilities has been discovered and corrected in
    postgresql :
    
    Fix incorrect password transformation in contrib/pgcrypto's DES
    crypt() function (Solar Designer). If a password string contained the
    byte value 0x80, the remainder of the password was ignored, causing
    the password to be much weaker than it appeared. With this fix, the
    rest of the string is properly included in the DES hash. Any stored
    password values that are affected by this bug will thus no longer
    match, so the stored values may need to be updated (CVE-2012-2143).
    
    Ignore SECURITY DEFINER and SET attributes for a procedural language's
    call handler (Tom Lane). Applying such attributes to a call handler
    could crash the server (CVE-2012-2655).
    
    This advisory provides the latest versions of PostgreSQL that is not
    vulnerable to these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/8.3/release-8-3-19.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/8.4/release-8-4-12.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/9.0/release-9-0-8.html"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:ND");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64ecpg8.4_6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64ecpg9.0_6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64pq8.4_5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64pq9.0_5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libecpg8.4_6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libecpg9.0_6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpq8.4_5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libpq9.0_5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-pl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-plpgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql8.4-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-pl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-plpgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.0-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2010.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2011");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK2010.1", cpu:"x86_64", reference:"lib64ecpg8.4_6-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", cpu:"x86_64", reference:"lib64pq8.4_5-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", cpu:"i386", reference:"libecpg8.4_6-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", cpu:"i386", reference:"libpq8.4_5-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-contrib-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-devel-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-docs-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-pl-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-plperl-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-plpgsql-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-plpython-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-pltcl-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.1", reference:"postgresql8.4-server-8.4.12-0.1mdv2010.2", yank:"mdv")) flag++;
    
    if (rpm_check(release:"MDK2011", cpu:"x86_64", reference:"lib64ecpg9.0_6-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", cpu:"x86_64", reference:"lib64pq9.0_5-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", cpu:"i386", reference:"libecpg9.0_6-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", cpu:"i386", reference:"libpq9.0_5-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-contrib-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-devel-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-docs-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-pl-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-plperl-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-plpgsql-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-plpython-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-pltcl-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2011", reference:"postgresql9.0-server-9.0.8-0.1-mdv2011.0", yank:"mdv")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2012-1336-1.NASL
    descriptionPostgreSQL was updated to the latest stable release 8.1.23, fixing various bugs and security issues. The following security issues have been fixed : - CVE-2012-3488: This update fixes arbitrary read and write of files via XSL functionality. - CVE-2012-2655: postgresql: denial of service (stack exhaustion) via specially crafted SQL. - CVE-2011-2483: crypt_blowfish was mishandling 8 bit characters. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2015-05-20
    plugin id83561
    published2015-05-20
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/83561
    titleSUSE SLED10 / SLES10 Security Update : PostgreSQL (SUSE-SU-2012:1336-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2012:1336-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(83561);
      script_version("2.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2011-2483", "CVE-2012-2655", "CVE-2012-3488", "CVE-2012-3489");
      script_bugtraq_id(49241, 53812, 55072, 55074);
    
      script_name(english:"SUSE SLED10 / SLES10 Security Update : PostgreSQL (SUSE-SU-2012:1336-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "PostgreSQL was updated to the latest stable release 8.1.23, fixing
    various bugs and security issues.
    
    The following security issues have been fixed :
    
      - CVE-2012-3488: This update fixes arbitrary read and
        write of files via XSL functionality.
    
      - CVE-2012-2655: postgresql: denial of service (stack
        exhaustion) via specially crafted SQL.
    
      - CVE-2011-2483: crypt_blowfish was mishandling 8 bit
        characters.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://download.suse.com/patch/finder/?keywords=ee84db0d1f4471abd4ab51536636eb1e
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d6a8ab54"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3488.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-3489.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/700876"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/765069"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/770193"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/776523"
      );
      # https://www.suse.com/support/update/announcement/2012/suse-su-20121336-1.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?9cf9ff4f"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected PostgreSQL packages"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql-pl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:10");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/10/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = eregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^(SLED10|SLES10)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED10 / SLES10", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLED10" && (! ereg(pattern:"^4$", string:sp))) audit(AUDIT_OS_NOT, "SLED10 SP4", os_ver + " SP" + sp);
    if (os_ver == "SLES10" && (! ereg(pattern:"^4$", string:sp))) audit(AUDIT_OS_NOT, "SLES10 SP4", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:"4", cpu:"x86_64", reference:"postgresql-devel-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLED10", sp:"4", cpu:"x86_64", reference:"postgresql-libs-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLED10", sp:"4", cpu:"x86_64", reference:"postgresql-libs-32bit-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLED10", sp:"4", cpu:"i586", reference:"postgresql-devel-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLED10", sp:"4", cpu:"i586", reference:"postgresql-libs-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", cpu:"x86_64", reference:"postgresql-libs-32bit-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", cpu:"s390x", reference:"postgresql-libs-32bit-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"postgresql-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"postgresql-contrib-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"postgresql-devel-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"postgresql-docs-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"postgresql-libs-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"postgresql-pl-8.1.23-0.11.1")) flag++;
    if (rpm_check(release:"SLES10", sp:"4", reference:"postgresql-server-8.1.23-0.11.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PostgreSQL");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-667.NASL
    description - Security and bugfix release 9.1.5 : - Ignore SECURITY DEFINER and SET attributes for a procedural language
    last seen2020-06-05
    modified2014-06-13
    plugin id74769
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74769
    titleopenSUSE Security Update : postgresql / postgresql-libs (openSUSE-SU-2012:1288-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-667.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74769);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2655", "CVE-2012-3488", "CVE-2012-3489");
    
      script_name(english:"openSUSE Security Update : postgresql / postgresql-libs (openSUSE-SU-2012:1288-1)");
      script_summary(english:"Check for the openSUSE-2012-667 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Security and bugfix release 9.1.5 :
    
      - Ignore SECURITY DEFINER and SET attributes for a
        procedural language's call handler (CVE-2012-2655)
        bnc#765069
    
      - Fix incorrect password transformation in
        'contrib/pgcrypto''s DES crypt() function
        (CVE-2012-2143) bnc#766799
    
      - Prevent access to external files/URLs via
        'contrib/xml2''s xslt_process() (CVE-2012-3488)
        bnc#776523
    
      - Prevent access to external files/URLs via XML entity
        references (CVE-2012-3489) bnc#776524
    
      - See the release notes for the rest of the changes:
        http://www.postgresql.org/docs/9.1/static/release.html
        /usr/share/doc/packages/postgresql/HISTORY"
      );
      # http://www.postgresql.org/docs/9.1/static/release.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/9.1/release.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=765069"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=766797"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=776523"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=776524"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql / postgresql-libs packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/09/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.2", reference:"libecpg6-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"libecpg6-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"libpq5-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"libpq5-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-contrib-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-contrib-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-debugsource-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-devel-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-devel-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-libs-debugsource-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-plperl-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-plperl-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-plpython-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-plpython-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-pltcl-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-pltcl-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-server-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", reference:"postgresql-server-debuginfo-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libpq5-32bit-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"libpq5-debuginfo-32bit-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"postgresql-devel-32bit-9.1.5-7.8.1") ) flag++;
    if ( rpm_check(release:"SUSE12.2", cpu:"x86_64", reference:"postgresql-devel-debuginfo-32bit-9.1.5-7.8.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libecpg6 / libecpg6-debuginfo / libpq5-32bit / libpq5 / etc");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120625_POSTGRESQL_AND_POSTGRESQL84_ON_SL5_X.NASL
    descriptionPostgreSQL is an advanced object-relational database management system (DBMS). A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143) Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated. A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language
    last seen2020-03-18
    modified2012-08-01
    plugin id61352
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61352
    titleScientific Linux Security Update : postgresql and postgresql84 on SL5.x i386/x86_64 (20120625)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61352);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2655");
    
      script_name(english:"Scientific Linux Security Update : postgresql and postgresql84 on SL5.x i386/x86_64 (20120625)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "PostgreSQL is an advanced object-relational database management system
    (DBMS).
    
    A flaw was found in the way the crypt() password hashing function from
    the optional PostgreSQL pgcrypto contrib module performed password
    transformation when used with the DES algorithm. If the password
    string to be hashed contained the 0x80 byte value, the remainder of
    the string was ignored when calculating the hash, significantly
    reducing the password strength. This made brute-force guessing more
    efficient as the whole password was not required to gain access to
    protected resources. (CVE-2012-2143)
    
    Note: With this update, the rest of the string is properly included in
    the DES hash; therefore, any previously stored password values that
    are affected by this issue will no longer match. In such cases, it
    will be necessary for those stored password hashes to be updated.
    
    A denial of service flaw was found in the way the PostgreSQL server
    performed a user privileges check when applying SECURITY DEFINER or
    SET attributes to a procedural language's (such as PL/Perl or
    PL/Python) call handler function. A non-superuser database owner could
    use this flaw to cause the PostgreSQL server to crash due to infinite
    recursion. (CVE-2012-2655)
    
    These updated packages upgrade PostgreSQL to version 8.4.12, which
    fixes these issues as well as several non-security issues. Refer to
    the PostgreSQL Release Notes for a full list of changes :
    
    http://www.postgresql.org/docs/8.4/static/release.html
    
    All PostgreSQL users are advised to upgrade to these updated packages,
    which correct these issues. If the postgresql service is running, it
    will be automatically restarted after installing this update."
      );
      # http://www.postgresql.org/docs/8.4/static/release.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/8.4/release.html"
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=722
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?66dc7164"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-python");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-tcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql84-test");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/07/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 5.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL5", reference:"postgresql84-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-contrib-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-debuginfo-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-devel-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-docs-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-libs-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-plperl-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-plpython-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-pltcl-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-python-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-server-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-tcl-8.4.12-1.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"postgresql84-test-8.4.12-1.el5_8")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql84 / postgresql84-contrib / postgresql84-debuginfo / etc");
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201209-24.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201209-24 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could spoof SSL connections. Furthermore, a remote authenticated attacker could cause a Denial of Service, read and write arbitrary files, inject SQL commands into dump scripts, or bypass database restrictions to execute database functions. A context-dependent attacker could more easily obtain access via authentication attempts with an initial substring of the intended password. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id62380
    published2012-09-29
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62380
    titleGLSA-201209-24 : PostgreSQL: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201209-24.
    #
    # The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(62380);
      script_version("1.11");
      script_cvs_date("Date: 2018/07/11 17:09:26");
    
      script_cve_id("CVE-2012-0866", "CVE-2012-0867", "CVE-2012-0868", "CVE-2012-2143", "CVE-2012-2655", "CVE-2012-3488", "CVE-2012-3489");
      script_bugtraq_id(52188, 53729, 53812, 55072, 55074);
      script_xref(name:"GLSA", value:"201209-24");
    
      script_name(english:"GLSA-201209-24 : PostgreSQL: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201209-24
    (PostgreSQL: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in PostgreSQL. Please
          review the CVE identifiers referenced below for details.
      
    Impact :
    
        A remote attacker could spoof SSL connections. Furthermore, a remote
          authenticated attacker could cause a Denial of Service, read and write
          arbitrary files, inject SQL commands into dump scripts, or bypass
          database restrictions to execute database functions.
        A context-dependent attacker could more easily obtain access via
          authentication attempts with an initial substring of the intended
          password.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201209-24"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All PostgreSQL 9.1 server users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-9.1.5'
        All PostgreSQL 9.0 server users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-9.0.9'
        All PostgreSQL 8.4 server users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-8.4.13'
        All PostgreSQL 8.3 server users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-8.3.20'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/09/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/09/29");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"dev-db/postgresql-server", unaffected:make_list("ge 9.1.5", "rge 9.0.9", "rge 8.4.13", "rge 8.3.20", "rge 8.4.17", "rge 8.4.19", "rge 9.0.13", "rge 9.0.14", "rge 9.0.15", "rge 8.4.14", "rge 8.4.15", "rge 8.4.16", "rge 9.0.16", "rge 9.0.17"), vulnerable:make_list("lt 9.1.5"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PostgreSQL");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-650.NASL
    description - Security and bugfix release 9.1.5 : - Ignore SECURITY DEFINER and SET attributes for a procedural language
    last seen2020-06-05
    modified2014-06-13
    plugin id74766
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74766
    titleopenSUSE Security Update : postgresql / postgresql-libs (openSUSE-SU-2012:1251-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-650.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74766);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2655", "CVE-2012-3488", "CVE-2012-3489");
    
      script_name(english:"openSUSE Security Update : postgresql / postgresql-libs (openSUSE-SU-2012:1251-1)");
      script_summary(english:"Check for the openSUSE-2012-650 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - Security and bugfix release 9.1.5 :
    
      - Ignore SECURITY DEFINER and SET attributes for a
        procedural language's call handler (CVE-2012-2655)
        bnc#765069
    
      - Fix incorrect password transformation in
        'contrib/pgcrypto''s DES crypt() function
        (CVE-2012-2143) bnc#766799
    
      - Prevent access to external files/URLs via
        'contrib/xml2''s xslt_process() (CVE-2012-3488)
        bnc#776523
    
      - Prevent access to external files/URLs via XML entity
        references (CVE-2012-3489) bnc#776524
    
      - See the release notes for the rest of the changes:
        http://www.postgresql.org/docs/9.1/static/release.html
        /usr/share/doc/packages/postgresql/HISTORY"
      );
      # http://www.postgresql.org/docs/9.1/static/release.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/9.1/release.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=765069"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=766797"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=776523"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=776524"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql / postgresql-libs packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-contrib-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-devel-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-libs-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plperl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-plpython-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-pltcl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql-server-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/09/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"libecpg6-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libecpg6-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libpq5-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"libpq5-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-contrib-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-contrib-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-debugsource-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-devel-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-devel-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-libs-debugsource-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-plperl-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-plperl-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-plpython-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-plpython-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-pltcl-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-pltcl-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-server-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"postgresql-server-debuginfo-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libpq5-32bit-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"libpq5-debuginfo-32bit-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"postgresql-devel-32bit-9.1.5-3.10.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", cpu:"x86_64", reference:"postgresql-devel-debuginfo-32bit-9.1.5-3.10.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libecpg6 / libecpg6-debuginfo / libpq5-32bit / libpq5 / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_POSTGRESQL-8311.NASL
    descriptionPostgreSQL was updated to the latest stable release 8.1.23, fixing various bugs and security issues. The following security issues have been fixed : - This update fixes arbitrary read and write of files via XSL functionality. (CVE-2012-3488) - postgresql: denial of service (stack exhaustion) via specially crafted SQL. (CVE-2012-2655) - crypt_blowfish was mishandling 8 bit characters. (CVE-2011-2483)
    last seen2020-06-05
    modified2012-10-15
    plugin id62545
    published2012-10-15
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62545
    titleSuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 8311)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1461-1.NASL
    descriptionIt was discovered that PostgreSQL incorrectly handled certain bytes passed to the crypt() function when using DES encryption. An attacker could use this flaw to incorrectly handle authentication. (CVE-2012-2143) It was discovered that PostgreSQL incorrectly handled SECURITY DEFINER and SET attributes on procedural call handlers. An attacker could use this flaw to cause PostgreSQL to crash, leading to a denial of service. (CVE-2012-2655). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id59385
    published2012-06-06
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59385
    titleUbuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1461-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-8915.NASL
    descriptionUpstream bug fix + security updates, including the fixes for CVE-2012-2143, CVE-2012-2655 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-06-18
    plugin id59538
    published2012-06-18
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59538
    titleFedora 15 : postgresql-9.0.8-1.fc15 (2012-8915)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-8924.NASL
    descriptionUpstream bug fix + security updates, including the fixes for CVE-2012-2143, CVE-2012-2655 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-06-18
    plugin id59539
    published2012-06-18
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59539
    titleFedora 17 : postgresql-9.1.4-1.fc17 (2012-8924)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120625_POSTGRESQL_AND_POSTGRESQL84_ON_SL6_X.NASL
    descriptionPostgreSQL is an advanced object-relational database management system (DBMS). A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143) Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated. A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language
    last seen2020-03-18
    modified2012-08-01
    plugin id61353
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61353
    titleScientific Linux Security Update : postgresql and postgresql84 on SL6.x i386/x86_64 (20120625)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-675.NASL
    descriptionThis version upgrade of PostgreSQL fixes following issues : - Bugfix release 9.0.10 : - Fix planner
    last seen2020-06-05
    modified2014-06-13
    plugin id74773
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74773
    titleopenSUSE Security Update : postgresql (openSUSE-SU-2012:1299-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-8893.NASL
    descriptionUpstream bug fix + security updates, including the fixes for CVE-2012-2143, CVE-2012-2655 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-06-18
    plugin id59534
    published2012-06-18
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59534
    titleFedora 16 : postgresql-9.1.4-1.fc16 (2012-8893)
  • NASL familyDatabases
    NASL idPOSTGRESQL_20120604.NASL
    descriptionThe version of PostgreSQL installed on the remote host is 8.3.x prior to 8.3.19, 8.4.x prior to 8.4.12, 9.0.x prior to 9.0.8, or 9.1.x prior to 9.1.4. As such, it is potentially affected by multiple vulnerabilities : - Passwords containing the byte 0x80 passed to the crypt() function in pgcrypto are incorrectly truncated if DES encryption was used. (CVE-2012-2143) - SECURITY_DEFINER and SET attributes on procedural call handlers are not ignored and can be used to crash the server. (CVE-2012-2655)
    last seen2020-06-01
    modified2020-06-02
    plugin id63353
    published2012-12-28
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63353
    titlePostgreSQL 8.3 < 8.3.19 / 8.4 < 8.4.12 / 9.0 < 9.0.8 / 9.1 < 9.1.4 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2491.NASL
    descriptionTwo vulnerabilities were discovered in PostgreSQL, a SQL database server : - CVE-2012-2143 The crypt(text, text) function in the pgcrypto contrib module did not handle certain passwords correctly when producing traditional DES-based hashes. Characters after the first 0x80 byte were ignored. - CVE-2012-2655 SECURITY DEFINER and SET attributes for a call handler of a procedural language could crash the database server. In addition, this update contains reliability and stability fixes from the 8.4.12 upstream release.
    last seen2020-03-17
    modified2012-06-29
    plugin id59769
    published2012-06-29
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59769
    titleDebian DSA-2491-1 : postgresql-8.4 - several vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-1037.NASL
    descriptionUpdated postgresql84 and postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143) Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated. A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language
    last seen2020-06-01
    modified2020-06-02
    plugin id59719
    published2012-06-27
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59719
    titleCentOS 5 / 6 : postgresql / postgresql84 (CESA-2012:1037)

Redhat

advisories
bugzilla
id825995
titleCVE-2012-2655 postgresql: Ability of database owners to install procedural languages via CREATE LANGUAGE found unsafe (DoS)
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 5 is installed
      ovaloval:com.redhat.rhba:tst:20070331005
    • OR
      • AND
        • commentpostgresql84-devel is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037001
        • commentpostgresql84-devel is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430024
      • AND
        • commentpostgresql84-libs is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037003
        • commentpostgresql84-libs is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430016
      • AND
        • commentpostgresql84-plpython is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037005
        • commentpostgresql84-plpython is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430002
      • AND
        • commentpostgresql84-docs is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037007
        • commentpostgresql84-docs is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430014
      • AND
        • commentpostgresql84-tcl is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037009
        • commentpostgresql84-tcl is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430018
      • AND
        • commentpostgresql84-pltcl is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037011
        • commentpostgresql84-pltcl is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430022
      • AND
        • commentpostgresql84-contrib is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037013
        • commentpostgresql84-contrib is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430004
      • AND
        • commentpostgresql84-python is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037015
        • commentpostgresql84-python is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430010
      • AND
        • commentpostgresql84 is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037017
        • commentpostgresql84 is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430006
      • AND
        • commentpostgresql84-plperl is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037019
        • commentpostgresql84-plperl is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430012
      • AND
        • commentpostgresql84-server is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037021
        • commentpostgresql84-server is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430020
      • AND
        • commentpostgresql84-test is earlier than 0:8.4.12-1.el5_8
          ovaloval:com.redhat.rhsa:tst:20121037023
        • commentpostgresql84-test is signed with Red Hat redhatrelease key
          ovaloval:com.redhat.rhsa:tst:20100430008
  • AND
    • commentRed Hat Enterprise Linux 6 is installed
      ovaloval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • commentpostgresql-libs is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037026
        • commentpostgresql-libs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908014
      • AND
        • commentpostgresql is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037028
        • commentpostgresql is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908002
      • AND
        • commentpostgresql-docs is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037030
        • commentpostgresql-docs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908010
      • AND
        • commentpostgresql-test is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037032
        • commentpostgresql-test is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908006
      • AND
        • commentpostgresql-server is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037034
        • commentpostgresql-server is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908020
      • AND
        • commentpostgresql-devel is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037036
        • commentpostgresql-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908016
      • AND
        • commentpostgresql-contrib is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037038
        • commentpostgresql-contrib is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908008
      • AND
        • commentpostgresql-plperl is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037040
        • commentpostgresql-plperl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908012
      • AND
        • commentpostgresql-pltcl is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037042
        • commentpostgresql-pltcl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908004
      • AND
        • commentpostgresql-plpython is earlier than 0:8.4.12-1.el6_2
          ovaloval:com.redhat.rhsa:tst:20121037044
        • commentpostgresql-plpython is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908018
rhsa
idRHSA-2012:1037
released2012-06-25
severityModerate
titleRHSA-2012:1037: postgresql and postgresql84 security update (Moderate)
rpms
  • postgresql-0:8.4.12-1.el6_2
  • postgresql-contrib-0:8.4.12-1.el6_2
  • postgresql-debuginfo-0:8.4.12-1.el6_2
  • postgresql-devel-0:8.4.12-1.el6_2
  • postgresql-docs-0:8.4.12-1.el6_2
  • postgresql-libs-0:8.4.12-1.el6_2
  • postgresql-plperl-0:8.4.12-1.el6_2
  • postgresql-plpython-0:8.4.12-1.el6_2
  • postgresql-pltcl-0:8.4.12-1.el6_2
  • postgresql-server-0:8.4.12-1.el6_2
  • postgresql-test-0:8.4.12-1.el6_2
  • postgresql84-0:8.4.12-1.el5_8
  • postgresql84-contrib-0:8.4.12-1.el5_8
  • postgresql84-debuginfo-0:8.4.12-1.el5_8
  • postgresql84-devel-0:8.4.12-1.el5_8
  • postgresql84-docs-0:8.4.12-1.el5_8
  • postgresql84-libs-0:8.4.12-1.el5_8
  • postgresql84-plperl-0:8.4.12-1.el5_8
  • postgresql84-plpython-0:8.4.12-1.el5_8
  • postgresql84-pltcl-0:8.4.12-1.el5_8
  • postgresql84-python-0:8.4.12-1.el5_8
  • postgresql84-server-0:8.4.12-1.el5_8
  • postgresql84-tcl-0:8.4.12-1.el5_8
  • postgresql84-test-0:8.4.12-1.el5_8

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 53812 CVE ID: CVE-2012-2655 PostgreSQL是一款高级对象-关系型数据库管理系统,支持扩展的SQL标准子集。 PostgreSQL在ALTER FUNCTION RENAME的实现上存在远程拒绝服务漏洞,利用此漏洞可允许攻击者使应用崩溃。 0 PostgreSQL 9.x PostgreSQL 8.x 厂商补丁: PostgreSQL ---------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.postgresql.org
idSSV:60186
last seen2017-11-19
modified2012-06-06
published2012-06-06
reporterRoot
titlePostgreSQL 'SECURITY DEFINER'和'SET'属性远程拒绝服务漏洞