Vulnerabilities > CVE-2014-0067 - Permissions, Privileges, and Access Controls vulnerability in multiple products

CVSS 4.6 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

local

low complexity

apple

postgresql

CWE-264

nessus

NVD

Published: 2014-03-31

Updated: 2017-12-16

Summary

The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.

Vulnerable Configurations

Part	Description	Count
OS	Apple Apple MAC OS X 10.10.4 Apple MAC OS X Server 5.0.3	2
Application	Postgresql Postgresql Postgresql 8.4.1 Postgresql Postgresql 8.4.2 Postgresql Postgresql 8.4.3 Postgresql Postgresql 8.4.4 Postgresql Postgresql 8.4.5 Postgresql Postgresql 8.4.6 Postgresql Postgresql 8.4.7 Postgresql Postgresql 8.4.8 Postgresql Postgresql 8.4.9 Postgresql Postgresql 8.4.10 Postgresql Postgresql 8.4.11 Postgresql Postgresql 8.4.12 Postgresql Postgresql 8.4.13 Postgresql Postgresql 8.4.14 Postgresql Postgresql 8.4.15 Postgresql Postgresql 8.4.16 Postgresql Postgresql 8.4.17 Postgresql Postgresql 8.4.18 Postgresql Postgresql - Postgresql Postgresql 1.0 Postgresql Postgresql 1.01 Postgresql Postgresql 1.02 Postgresql Postgresql 1.08 Postgresql Postgresql 1.09 Postgresql Postgresql 6.0 Postgresql Postgresql 6.1 Postgresql Postgresql 6.1.1 Postgresql Postgresql 6.2 Postgresql Postgresql 6.2.1 Postgresql Postgresql 6.3 Postgresql Postgresql 6.3.1 Postgresql Postgresql 6.3.2 Postgresql Postgresql 6.4 Postgresql Postgresql 6.4.1 Postgresql Postgresql 6.4.2 Postgresql Postgresql 6.5 Postgresql Postgresql 6.5.1 Postgresql Postgresql 6.5.2 Postgresql Postgresql 6.5.3 Postgresql Postgresql 7.0 Postgresql Postgresql 7.0.1 Postgresql Postgresql 7.0.2 Postgresql Postgresql 7.0.3 Postgresql Postgresql 7.1 Postgresql Postgresql 7.1.1 Postgresql Postgresql 7.1.2 Postgresql Postgresql 7.1.3 Postgresql Postgresql 7.2 Postgresql Postgresql 7.2.1 Postgresql Postgresql 7.2.2 Postgresql Postgresql 7.2.3 Postgresql Postgresql 7.2.4 Postgresql Postgresql 7.2.5 Postgresql Postgresql 7.2.6 Postgresql Postgresql 7.2.7 Postgresql Postgresql 7.2.8 Postgresql Postgresql 7.3 Postgresql Postgresql 7.3.0 Postgresql Postgresql 7.3.1 Postgresql Postgresql 7.3.2 Postgresql Postgresql 7.3.3 Postgresql Postgresql 7.3.4 Postgresql Postgresql 7.3.5 Postgresql Postgresql 7.3.6 Postgresql Postgresql 7.3.7 Postgresql Postgresql 7.3.8 Postgresql Postgresql 7.3.9 Postgresql Postgresql 7.3.10 Postgresql Postgresql 7.3.11 Postgresql Postgresql 7.3.12 Postgresql Postgresql 7.3.13 Postgresql Postgresql 7.3.14 Postgresql Postgresql 7.3.15 Postgresql Postgresql 7.3.16 Postgresql Postgresql 7.3.17 Postgresql Postgresql 7.3.18 Postgresql Postgresql 7.3.19 Postgresql Postgresql 7.3.20 Postgresql Postgresql 7.3.21 Postgresql Postgresql 7.4 Postgresql Postgresql 7.4.1 Postgresql Postgresql 7.4.2 Postgresql Postgresql 7.4.3 Postgresql Postgresql 7.4.4 Postgresql Postgresql 7.4.5 Postgresql Postgresql 7.4.6 Postgresql Postgresql 7.4.7 Postgresql Postgresql 7.4.8 Postgresql Postgresql 7.4.9 Postgresql Postgresql 7.4.10 Postgresql Postgresql 7.4.11 Postgresql Postgresql 7.4.12 Postgresql Postgresql 7.4.13 Postgresql Postgresql 7.4.14 Postgresql Postgresql 7.4.15 Postgresql Postgresql 7.4.16 Postgresql Postgresql 7.4.17 Postgresql Postgresql 7.4.18 Postgresql Postgresql 7.4.19 Postgresql Postgresql 7.4.20 Postgresql Postgresql 7.4.21 Postgresql Postgresql 7.4.22 Postgresql Postgresql 7.4.23 Postgresql Postgresql 7.4.24 Postgresql Postgresql 7.4.25 Postgresql Postgresql 7.4.26 Postgresql Postgresql 7.4.27 Postgresql Postgresql 7.4.28 Postgresql Postgresql 7.4.29 Postgresql Postgresql 7.4.30 Postgresql Postgresql 8.0 Postgresql Postgresql 8.0.1 Postgresql Postgresql 8.0.2 Postgresql Postgresql 8.0.3 Postgresql Postgresql 8.0.4 Postgresql Postgresql 8.0.5 Postgresql Postgresql 8.0.6 Postgresql Postgresql 8.0.7 Postgresql Postgresql 8.0.8 Postgresql Postgresql 8.0.9 Postgresql Postgresql 8.0.10 Postgresql Postgresql 8.0.11 Postgresql Postgresql 8.0.12 Postgresql Postgresql 8.0.13 Postgresql Postgresql 8.0.14 Postgresql Postgresql 8.0.15 Postgresql Postgresql 8.0.16 Postgresql Postgresql 8.0.17 Postgresql Postgresql 8.0.18 Postgresql Postgresql 8.0.19 Postgresql Postgresql 8.0.20 Postgresql Postgresql 8.0.21 Postgresql Postgresql 8.0.22 Postgresql Postgresql 8.0.23 Postgresql Postgresql 8.0.24 Postgresql Postgresql 8.0.25 Postgresql Postgresql 8.0.26 Postgresql Postgresql 8.1 Postgresql Postgresql 8.1.0 Postgresql Postgresql 8.1.1 Postgresql Postgresql 8.1.2 Postgresql Postgresql 8.1.3 Postgresql Postgresql 8.1.4 Postgresql Postgresql 8.1.5 Postgresql Postgresql 8.1.6 Postgresql Postgresql 8.1.7 Postgresql Postgresql 8.1.8 Postgresql Postgresql 8.1.9 Postgresql Postgresql 8.1.10 Postgresql Postgresql 8.1.11 Postgresql Postgresql 8.1.12 Postgresql Postgresql 8.1.13 Postgresql Postgresql 8.1.14 Postgresql Postgresql 8.1.15 Postgresql Postgresql 8.1.16 Postgresql Postgresql 8.1.17 Postgresql Postgresql 8.1.18 Postgresql Postgresql 8.1.19 Postgresql Postgresql 8.1.20 Postgresql Postgresql 8.1.21 Postgresql Postgresql 8.1.22 Postgresql Postgresql 8.1.23 Postgresql Postgresql 8.2 Postgresql Postgresql 8.2.0 Postgresql Postgresql 8.2.1 Postgresql Postgresql 8.2.2 Postgresql Postgresql 8.2.3 Postgresql Postgresql 8.2.4 Postgresql Postgresql 8.2.5 Postgresql Postgresql 8.2.6 Postgresql Postgresql 8.2.7 Postgresql Postgresql 8.2.8 Postgresql Postgresql 8.2.9 Postgresql Postgresql 8.2.10 Postgresql Postgresql 8.2.11 Postgresql Postgresql 8.2.12 Postgresql Postgresql 8.2.13 Postgresql Postgresql 8.2.14 Postgresql Postgresql 8.2.15 Postgresql Postgresql 8.2.16 Postgresql Postgresql 8.2.17 Postgresql Postgresql 8.2.18 Postgresql Postgresql 8.2.19 Postgresql Postgresql 8.2.20 Postgresql Postgresql 8.2.21 Postgresql Postgresql 8.2.22 Postgresql Postgresql 8.2.23 Postgresql Postgresql 8.3 Postgresql Postgresql 8.3.0 Postgresql Postgresql 8.3.1 Postgresql Postgresql 8.3.2 Postgresql Postgresql 8.3.3 Postgresql Postgresql 8.3.4 Postgresql Postgresql 8.3.5 Postgresql Postgresql 8.3.6 Postgresql Postgresql 8.3.7 Postgresql Postgresql 8.3.8 Postgresql Postgresql 8.3.9 Postgresql Postgresql 8.3.10 Postgresql Postgresql 8.3.11 Postgresql Postgresql 8.3.12 Postgresql Postgresql 8.3.13 Postgresql Postgresql 8.3.14 Postgresql Postgresql 8.3.15 Postgresql Postgresql 8.3.16 Postgresql Postgresql 8.3.17 Postgresql Postgresql 8.3.18 Postgresql Postgresql 8.3.19 Postgresql Postgresql 8.3.20 Postgresql Postgresql 8.3.21 Postgresql Postgresql 8.3.22 Postgresql Postgresql 8.3.23 Postgresql Postgresql 8.4 Postgresql Postgresql 8.4.0 Postgresql Postgresql 8.4.19 Postgresql Postgresql 9.0 Postgresql Postgresql 9.0.1 Postgresql Postgresql 9.0.2 Postgresql Postgresql 9.0.3 Postgresql Postgresql 9.0.4 Postgresql Postgresql 9.0.5 Postgresql Postgresql 9.0.6 Postgresql Postgresql 9.0.7 Postgresql Postgresql 9.0.8 Postgresql Postgresql 9.0.9 Postgresql Postgresql 9.0.10 Postgresql Postgresql 9.0.11 Postgresql Postgresql 9.0.12 Postgresql Postgresql 9.0.13 Postgresql Postgresql 9.0.14 Postgresql Postgresql 9.0.15 Postgresql Postgresql 9.1 Postgresql Postgresql 9.1.1 Postgresql Postgresql 9.1.2 Postgresql Postgresql 9.1.3 Postgresql Postgresql 9.1.4 Postgresql Postgresql 9.1.5 Postgresql Postgresql 9.1.6 Postgresql Postgresql 9.1.7 Postgresql Postgresql 9.1.8 Postgresql Postgresql 9.1.9 Postgresql Postgresql 9.1.10 Postgresql Postgresql 9.1.11 Postgresql Postgresql 9.2 Postgresql Postgresql 9.2.1 Postgresql Postgresql 9.2.2 Postgresql Postgresql 9.2.3 Postgresql Postgresql 9.2.4 Postgresql Postgresql 9.2.5 Postgresql Postgresql 9.2.6 Postgresql Postgresql 9.3 Postgresql Postgresql 9.3.1 Postgresql Postgresql 9.3.2	255

Common Weakness Enumeration (CWE)

CWE-264 - Permissions, Privileges, and Access Controls

Common Attack Pattern Enumeration and Classification (CAPEC)

Accessing, Modifying or Executing Executable Files
An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
Blue Boxing
This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
Restful Privilege Elevation
Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
Target Programs with Elevated Privileges
This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-19.NASL
description	New upstream minor release. Users should upgrade to this version at their next scheduled maintenance window. Noteworthy change : Secure Unix-domain sockets of temporary postmasters started during make check (Noah Misch) Any local user able to access the socket file could connect as the server
last seen	2020-03-17
modified	2015-03-26
plugin id	82167
published	2015-03-26
reporter	This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/82167
title	Debian DLA-19-1 : postgresql-8.4 update
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DLA-19-1. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(82167); script_version("1.5"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2014-0067"); script_bugtraq_id(65721); script_name(english:"Debian DLA-19-1 : postgresql-8.4 update"); script_summary(english:"Checks dpkg output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security update." ); script_set_attribute( attribute:"description", value: "New upstream minor release. Users should upgrade to this version at their next scheduled maintenance window. Noteworthy change : Secure Unix-domain sockets of temporary postmasters started during make check (Noah Misch) Any local user able to access the socket file could connect as the server's bootstrap superuser, then proceed to execute arbitrary code as the operating-system user running the test, as we previously noted in CVE-2014-0067. This change defends against that risk by placing the server's socket in a temporary, mode 0700 subdirectory of /tmp. 8.4.22 marks the end of life of the PostgreSQL 8.4 branch. No further releases will be made by the PostgreSQL Global Development Group. Users of PostgreSQL 8.4 should look into upgrading to a newer PostgreSQL release. Options are : - Upgrading to Debian 7 (Wheezy), providing postgresql-9.1. - The use of the apt.postgresql.org repository, providing packages for all active PostgreSQL branches (9.0 up to 9.4 at the time of writing). See https://wiki.postgresql.org/wiki/Apt for more information about the repository. A helper script to activate the repository is provided in /usr/share/doc/postgresql-8.4/examples/apt.postgresql.or g.sh. - An LTS version of 8.4 is in planning that will cover the lifetime of squeeze-lts. Updates will probably made on a best-effort basis. Users can take advantage of this, but should still consider upgrading to newer PostgreSQL versions over the next months. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://lists.debian.org/debian-lts-announce/2014/07/msg00008.html" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/squeeze-lts/postgresql-8.4" ); script_set_attribute( attribute:"see_also", value:"https://wiki.postgresql.org/wiki/Apt" ); script_set_attribute(attribute:"solution", value:"Upgrade the affected packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecpg-compat3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecpg-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libecpg6"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpgtypes3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpq-dev"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libpq5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-8.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-client-8.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-contrib-8.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-doc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-doc-8.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-plperl-8.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-plpython-8.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-pltcl-8.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-server-dev-8.4"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0"); script_set_attribute(attribute:"patch_publication_date", value:"2014/07/29"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/26"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2020 Tenable Network Security, Inc."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"6.0", prefix:"libecpg-compat3", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"libecpg-dev", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"libecpg6", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"libpgtypes3", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"libpq-dev", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"libpq5", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-client", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-client-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-contrib", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-contrib-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-doc", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-doc-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-plperl-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-plpython-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-pltcl-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (deb_check(release:"6.0", prefix:"postgresql-server-dev-8.4", reference:"8.4.22-0+deb6u1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2014-047.NASL
description	Multiple vulnerabilities has been discovered and corrected in postgresql : Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions (CVE-2014-0060). The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any (CVE-2014-0061). If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack (CVE-2014-0062). The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own (CVE-2014-0063). Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past (CVE-2014-0064). Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type (CVE-2014-0065). There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., FIPS mode) (CVE-2014-0066). Since the temporary server started by make check uses trust authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine (CVE-2014-0067). This advisory provides the latest version of PostgreSQL that is not vulnerable to these issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	72642
published	2014-02-23
reporter	This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/72642
title	Mandriva Linux Security Advisory : postgresql (MDVSA-2014:047)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandriva Linux Security Advisory MDVSA-2014:047. # The text itself is copyright (C) Mandriva S.A. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(72642); script_version("1.13"); script_cvs_date("Date: 2019/08/02 13:32:55"); script_cve_id("CVE-2014-0060", "CVE-2014-0061", "CVE-2014-0062", "CVE-2014-0063", "CVE-2014-0064", "CVE-2014-0065", "CVE-2014-0066", "CVE-2014-0067"); script_bugtraq_id(65719, 65721, 65723, 65724, 65725, 65727, 65728, 65731); script_xref(name:"MDVSA", value:"2014:047"); script_name(english:"Mandriva Linux Security Advisory : postgresql (MDVSA-2014:047)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandriva Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Multiple vulnerabilities has been discovered and corrected in postgresql : Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions (CVE-2014-0060). The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any (CVE-2014-0061). If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack (CVE-2014-0062). The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own (CVE-2014-0063). Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past (CVE-2014-0064). Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type (CVE-2014-0065). There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., FIPS mode) (CVE-2014-0066). Since the temporary server started by make check uses trust authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine (CVE-2014-0067). This advisory provides the latest version of PostgreSQL that is not vulnerable to these issues." ); script_set_attribute( attribute:"see_also", value:"https://www.postgresql.org/docs/9.2/release-9-2-5.html" ); script_set_attribute( attribute:"see_also", value:"https://www.postgresql.org/docs/9.2/release-9-2-6.html" ); script_set_attribute( attribute:"see_also", value:"https://www.postgresql.org/docs/9.2/release-9-2-7.html" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64ecpg9.2_6"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64pq9.2_5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-docs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-pl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-plperl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-plpgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-plpython"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-pltcl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:postgresql9.2-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:business_server:1"); script_set_attribute(attribute:"patch_publication_date", value:"2014/02/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/23"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64\|i[3-6]86\|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"lib64ecpg9.2_6-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"lib64pq9.2_5-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-contrib-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-devel-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", reference:"postgresql9.2-docs-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-pl-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-plperl-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-plpgsql-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-plpython-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-pltcl-9.2.7-1.mbs1")) flag++; if (rpm_check(release:"MDK-MBS1", cpu:"x86_64", reference:"postgresql9.2-server-9.2.7-1.mbs1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_42D420909A4D11E3B02908002798F6FF.NASL
description	PostgreSQL Project reports : This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN OPTION permission. It also fixes multiple privilege escalation issues, including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, and CVE-2014-0066. More information on these issues can be found on our security page and the security issue detail wiki page. With this release, we are also alerting users to a known security hole that allows other users on the same machine to gain access to an operating system account while it is doing
last seen	2020-06-01
modified	2020-06-02
plugin id	72612
published	2014-02-21
reporter	This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/72612
title	FreeBSD : PostgreSQL -- multiple privilege issues (42d42090-9a4d-11e3-b029-08002798f6ff)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2018 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(72612); script_version("1.7"); script_cvs_date("Date: 2018/11/10 11:49:43"); script_cve_id("CVE-2014-0060", "CVE-2014-0061", "CVE-2014-0062", "CVE-2014-0063", "CVE-2014-0064", "CVE-2014-0065", "CVE-2014-0066", "CVE-2014-0067"); script_name(english:"FreeBSD : PostgreSQL -- multiple privilege issues (42d42090-9a4d-11e3-b029-08002798f6ff)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "PostgreSQL Project reports : This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN OPTION permission. It also fixes multiple privilege escalation issues, including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, and CVE-2014-0066. More information on these issues can be found on our security page and the security issue detail wiki page. With this release, we are also alerting users to a known security hole that allows other users on the same machine to gain access to an operating system account while it is doing 'make check' : CVE-2014-0067. 'Make check' is normally part of building PostgreSQL from source code. As it is not possible to fix this issue without causing significant issues to our testing infrastructure, a patch will be released separately and publicly. Until then, users are strongly advised not to run 'make check' on machines where untrusted users have accounts." ); # https://vuxml.freebsd.org/freebsd/42d42090-9a4d-11e3-b029-08002798f6ff.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?4598304a" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:postgresql-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/02/20"); script_set_attribute(attribute:"patch_publication_date", value:"2014/02/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/21"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"postgresql-server<8.4.20")) flag++; if (pkg_test(save_report:TRUE, pkg:"postgresql-server>=9.0.0<9.0.16")) flag++; if (pkg_test(save_report:TRUE, pkg:"postgresql-server>=9.1.0<9.1.12")) flag++; if (pkg_test(save_report:TRUE, pkg:"postgresql-server>=9.2.0<9.2.7")) flag++; if (pkg_test(save_report:TRUE, pkg:"postgresql-server>=9.3.0<9.3.3")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2014-192.NASL
description	The PostgreSQL database was updated to the security and bugfix release 9.2.7, which following fixes : - Shore up GRANT ... WITH ADMIN OPTION restrictions (CVE-2014-0060, bnc#864845) - Prevent privilege escalation via manual calls to PL validator functions (CVE-2014-0061, bnc#864846) - Avoid multiple name lookups during table and index DDL (CVE-2014-0062, bnc#864847) - Prevent buffer overrun with long datetime strings (CVE-2014-0063, bnc#864850) - Prevent buffer overrun due to integer overflow in size calculations (CVE-2014-0064, bnc#864851) - Prevent overruns of fixed-size buffers (CVE-2014-0065, bnc#864852) - Avoid crashing if crypt() returns NULL (CVE-2014-0066, bnc#864853) - Document risks of make check in the regression testing instructions (CVE-2014-0067) - For the other (many!) bug fixes, see the release notes: http://www.postgresql.org/docs/9.3/static/release-9-2-7. html
last seen	2020-06-05
modified	2014-06-13
plugin id	75281
published	2014-06-13
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/75281
title	openSUSE Security Update : postgresql92 (openSUSE-SU-2014:0345-1)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update openSUSE-2014-192. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(75281); script_version("1.7"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2014-0060", "CVE-2014-0061", "CVE-2014-0062", "CVE-2014-0063", "CVE-2014-0064", "CVE-2014-0065", "CVE-2014-0066", "CVE-2014-0067"); script_name(english:"openSUSE Security Update : postgresql92 (openSUSE-SU-2014:0345-1)"); script_summary(english:"Check for the openSUSE-2014-192 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "The PostgreSQL database was updated to the security and bugfix release 9.2.7, which following fixes : - Shore up GRANT ... WITH ADMIN OPTION restrictions (CVE-2014-0060, bnc#864845) - Prevent privilege escalation via manual calls to PL validator functions (CVE-2014-0061, bnc#864846) - Avoid multiple name lookups during table and index DDL (CVE-2014-0062, bnc#864847) - Prevent buffer overrun with long datetime strings (CVE-2014-0063, bnc#864850) - Prevent buffer overrun due to integer overflow in size calculations (CVE-2014-0064, bnc#864851) - Prevent overruns of fixed-size buffers (CVE-2014-0065, bnc#864852) - Avoid crashing if crypt() returns NULL (CVE-2014-0066, bnc#864853) - Document risks of make check in the regression testing instructions (CVE-2014-0067) - For the other (many!) bug fixes, see the release notes: http://www.postgresql.org/docs/9.3/static/release-9-2-7. html" ); # http://www.postgresql.org/docs/9.3/static/release-9-2-7.html script_set_attribute( attribute:"see_also", value:"https://www.postgresql.org/docs/9.3/release-9-2-7.html" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=864845" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=864846" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=864847" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=864850" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=864851" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=864852" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=864853" ); script_set_attribute( attribute:"see_also", value:"https://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html" ); script_set_attribute( attribute:"solution", value:"Update the affected postgresql92 packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo-32bit"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-contrib-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-devel-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-libs-debugsource"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-plperl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-plperl-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-plpython"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-plpython-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-pltcl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-pltcl-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql92-server-debuginfo"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1"); script_set_attribute(attribute:"patch_publication_date", value:"2014/02/28"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release =~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE12\.3\|SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.3 / 13.1", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586\|i686\|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE12.3", reference:"libecpg6-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libecpg6-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libpq5-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"libpq5-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-contrib-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-contrib-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-debugsource-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-devel-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-devel-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-libs-debugsource-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-plperl-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-plperl-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-plpython-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-plpython-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-pltcl-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-pltcl-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-server-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", reference:"postgresql92-server-debuginfo-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libecpg6-32bit-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libecpg6-debuginfo-32bit-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libpq5-32bit-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE12.3", cpu:"x86_64", reference:"libpq5-debuginfo-32bit-9.2.7-1.12.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libecpg6-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libecpg6-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libpq5-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"libpq5-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-contrib-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-contrib-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-debugsource-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-devel-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-devel-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-libs-debugsource-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-plperl-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-plperl-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-plpython-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-plpython-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-pltcl-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-pltcl-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-server-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", reference:"postgresql92-server-debuginfo-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libecpg6-32bit-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libecpg6-debuginfo-32bit-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libpq5-32bit-9.2.7-4.4.1") ) flag++; if ( rpm_check(release:"SUSE13.1", cpu:"x86_64", reference:"libpq5-debuginfo-32bit-9.2.7-4.4.1") ) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql92"); }

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_10_10_5.NASL
description	The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - Apple ID OD Plug-in - AppleGraphicsControl - Bluetooth - bootp - CloudKit - CoreMedia Playback - CoreText - curl - Data Detectors Engine - Date & Time pref pane - Dictionary Application - DiskImages - dyld - FontParser - groff - ImageIO - Install Framework Legacy - IOFireWireFamily - IOGraphics - IOHIDFamily - Kernel - Libc - Libinfo - libpthread - libxml2 - libxpc - mail_cmds - Notification Center OSX - ntfs - OpenSSH - OpenSSL - perl - PostgreSQL - python - QL Office - Quartz Composer Framework - Quick Look - QuickTime 7 - SceneKit - Security - SMBClient - Speech UI - sudo - tcpdump - Text Formats - udf Note that successful exploitation of the most serious issues can result in arbitrary code execution.
last seen	2020-06-01
modified	2020-06-02
plugin id	85408
published	2015-08-17
reporter	This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/85408
title	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SECUPD2015-006.NASL
description	The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - CoreText - FontParser - Libinfo - libxml2 - OpenSSL - perl - PostgreSQL - QL Office - Quartz Composer Framework - QuickTime 7 - SceneKit Note that successful exploitation of the most serious issues can result in arbitrary code execution.
last seen	2020-06-01
modified	2020-06-02
plugin id	85409
published	2015-08-17
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/85409
title	Mac OS X Multiple Vulnerabilities (Security Update 2015-006)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-2865.NASL
description	Various vulnerabilities were discovered in PostgreSQL : - CVE-2014-0060 Shore up GRANT ... WITH ADMIN OPTION restrictions (Noah Misch) Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions. - CVE-2014-0061 Prevent privilege escalation via manual calls to PL validator functions (Andres Freund) The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any. - CVE-2014-0062 Avoid multiple name lookups during table and index DDL (Robert Haas, Andres Freund) If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack. - CVE-2014-0063 Prevent buffer overrun with long datetime strings (Noah Misch) The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own. - CVE-2014-0064 CVE-2014-2669 Prevent buffer overrun due to integer overflow in size calculations (Noah Misch, Heikki Linnakangas) Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past. - CVE-2014-0065 Prevent overruns of fixed-size buffers (Peter Eisentraut, Jozef Mlich) Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type. - CVE-2014-0066 Avoid crashing if crypt() returns NULL (Honza Horak, Bruce Momjian) There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g.,
last seen	2020-03-17
modified	2014-02-21
plugin id	72611
published	2014-02-21
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/72611
title	Debian DSA-2865-1 : postgresql-9.1 - several vulnerabilities

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-2864.NASL
description	Various vulnerabilities were discovered in PostgreSQL : - CVE-2014-0060 Shore up GRANT ... WITH ADMIN OPTION restrictions (Noah Misch) Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions. - CVE-2014-0061 Prevent privilege escalation via manual calls to PL validator functions (Andres Freund) The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any. - CVE-2014-0062 Avoid multiple name lookups during table and index DDL (Robert Haas, Andres Freund) If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack. - CVE-2014-0063 Prevent buffer overrun with long datetime strings (Noah Misch) The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own. - CVE-2014-0064 Prevent buffer overrun due to integer overflow in size calculations (Noah Misch, Heikki Linnakangas) Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past. - CVE-2014-0065 Prevent overruns of fixed-size buffers (Peter Eisentraut, Jozef Mlich) Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type. - CVE-2014-0066 Avoid crashing if crypt() returns NULL (Honza Horak, Bruce Momjian) There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g.,
last seen	2020-03-17
modified	2014-02-21
plugin id	72610
published	2014-02-21
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/72610
title	Debian DSA-2864-1 : postgresql-8.4 - several vulnerabilities

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SERVER_5_0_3.NASL
description	The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the mod_headers module that allows HTTP trailers to replace HTTP headers late during request processing. A remote attacker can exploit this to inject arbitrary headers. This can also cause some modules to function incorrectly or appear to function incorrectly. (CVE-2013-5704) - A privilege escalation vulnerability exists due to the
last seen	2020-06-01
modified	2020-06-02
plugin id	86066
published	2015-09-22
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86066
title	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities

NASL family	Databases
NASL id	POSTGRESQL_20150205.NASL
description	The version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.19, 9.1.x prior to 9.1.15, 9.2.x prior to 9.2.10, 9.3.x prior to 9.3.6, or 9.4.x prior to 9.4.1. It is, therefore, affected by multiple vulnerabilities : - A privilege escalation vulnerability exists due to the
last seen	2020-06-01
modified	2020-06-02
plugin id	81300
published	2015-02-11
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/81300
title	PostgreSQL 9.0 < 9.0.19 / 9.1 < 9.1.15 / 9.2 < 9.2.10 / 9.3 < 9.3.6 / 9.4 < 9.4.1 Multiple Vulnerabilities

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2015-110.NASL
description	Updated postgresql packages fix multiple security vulnerabilities : Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions (CVE-2014-0060). The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any (CVE-2014-0061). If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack (CVE-2014-0062). The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own (CVE-2014-0063). Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past (CVE-2014-0064). Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type (CVE-2014-0065). There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., FIPS mode) (CVE-2014-0066). Since the temporary server started by make check uses trust authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine (CVE-2014-0067). A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages (CVE-2014-8161). The function to_char() might read/write past the end of a buffer. This might crash the server when a formatting template is processed (CVE-2015-0241). The pgcrypto module is vulnerable to stack buffer overrun that might crash the server (CVE-2015-0243). Emil Lenngren reported that an attacker can inject SQL commands when the synchronization between client and server is lost (CVE-2015-0244). This update provides PostgreSQL versions 9.3.6 and 9.2.10 that fix these issues, as well as several others.
last seen	2020-06-01
modified	2020-06-02
plugin id	82363
published	2015-03-30
reporter	This script is Copyright (C) 2015-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/82363
title	Mandriva Linux Security Advisory : postgresql (MDVSA-2015:110)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2015-492.NASL
description	A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A buffer overflow flaw was found in the PostgreSQL
last seen	2020-06-01
modified	2020-06-02
plugin id	81828
published	2015-03-17
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/81828
title	Amazon Linux AMI : postgresql92 (ALAS-2015-492)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_LIBECPG6-140303.NASL
description	The PostgreSQL database server was updated to version 9.1.12 to fix various security issues : - Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions. (CVE-2014-0060) - The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any. (CVE-2014-0061) - If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack. (CVE-2014-0062) - The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own. (CVE-2014-0063) - Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past. (CVE-2014-0064) - Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type. (CVE-2014-0065) - There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g.,
last seen	2020-06-05
modified	2014-03-31
plugin id	73268
published	2014-03-31
reporter	This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/73268
title	SuSE 11.3 Security Update : PostgreSQL 9.1 (SAT Patch Number 8970)

Seebug

bulletinFamily	exploit
description	BUGTRAQ ID: 65721 CVE(CAN) ID: CVE-2014-0067 PostgreSQL是一款高级对象－关系型数据库管理系统，支持扩展的SQL标准子集。 PostgreSQL 9.3.3, 9.2.7, 9.1.12, 9.0.16, 8.4.20之前版本通过"make check"在构造树内运行回归测试时，服务器进程允许同一台机器上的用户作为超级用户登录，另外一个本地用户也可以获取操作系统用户的权限。 0 PostgreSQL PostgreSQL 8.x 厂商补丁： PostgreSQL ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.postgresql.org
id	SSV:61544
last seen	2017-11-19
modified	2014-02-25
published	2014-02-25
reporter	Root
title	PostgreSQL 'make check' 本地权限提升漏洞

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Seebug

References