Vulnerabilities > CVE-2014-2669 - Numeric Errors vulnerability in Postgresql
Summary
Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow. NOTE: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2014-0221.NASL description The remote CentOS host is missing a security update which has been documented in Red Hat advisory RHSA-2014:0221. last seen 2020-06-01 modified 2020-06-02 plugin id 72865 published 2014-03-07 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72865 title CentOS 6 : postgresql92-postgresql (CESA-2014:0221) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2014:0221 and # CentOS Errata and Security Advisory 2014:0221 respectively. # include("compat.inc"); if (description) { script_id(72865); script_version("1.8"); script_cvs_date("Date: 2020/01/06"); script_cve_id("CVE-2014-0060", "CVE-2014-0061", "CVE-2014-0062", "CVE-2014-0063", "CVE-2014-0064", "CVE-2014-0065", "CVE-2014-0066", "CVE-2014-2669"); script_xref(name:"RHSA", value:"2014:0221"); script_name(english:"CentOS 6 : postgresql92-postgresql (CESA-2014:0221)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "The remote CentOS host is missing a security update which has been documented in Red Hat advisory RHSA-2014:0221." ); # https://lists.centos.org/pipermail/centos-announce/2014-February/020182.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?5bdd8abe" ); script_set_attribute( attribute:"solution", value:"Update the affected postgresql92-postgresql packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-0061"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-docs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-plperl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-plpython"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-pltcl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-test"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos-scl:postgresql92-postgresql-upgrade"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:6"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/31"); script_set_attribute(attribute:"patch_publication_date", value:"2014/02/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/03/07"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 6.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-contrib-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-devel-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-docs-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-libs-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-plperl-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-plpython-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-pltcl-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-server-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-test-9.2.7-1.1.el6.centos.alt")) flag++; if (rpm_check(release:"CentOS-6", cpu:"x86_64", reference:"postgresql92-postgresql-upgrade-9.2.7-1.1.el6.centos.alt")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql92-postgresql / postgresql92-postgresql-contrib / etc"); }
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2865.NASL description Various vulnerabilities were discovered in PostgreSQL : - CVE-2014-0060 Shore up GRANT ... WITH ADMIN OPTION restrictions (Noah Misch) Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions. - CVE-2014-0061 Prevent privilege escalation via manual calls to PL validator functions (Andres Freund) The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any. - CVE-2014-0062 Avoid multiple name lookups during table and index DDL (Robert Haas, Andres Freund) If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack. - CVE-2014-0063 Prevent buffer overrun with long datetime strings (Noah Misch) The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own. - CVE-2014-0064 CVE-2014-2669 Prevent buffer overrun due to integer overflow in size calculations (Noah Misch, Heikki Linnakangas) Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past. - CVE-2014-0065 Prevent overruns of fixed-size buffers (Peter Eisentraut, Jozef Mlich) Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type. - CVE-2014-0066 Avoid crashing if crypt() returns NULL (Honza Horak, Bruce Momjian) There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., last seen 2020-03-17 modified 2014-02-21 plugin id 72611 published 2014-02-21 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72611 title Debian DSA-2865-1 : postgresql-9.1 - several vulnerabilities code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Debian Security Advisory DSA-2865. The text # itself is copyright (C) Software in the Public Interest, Inc. # include("compat.inc"); if (description) { script_id(72611); script_version("1.22"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12"); script_cve_id("CVE-2014-0060", "CVE-2014-0061", "CVE-2014-0062", "CVE-2014-0063", "CVE-2014-0064", "CVE-2014-0065", "CVE-2014-0066", "CVE-2014-0067", "CVE-2014-2669"); script_bugtraq_id(65728); script_xref(name:"DSA", value:"2865"); script_name(english:"Debian DSA-2865-1 : postgresql-9.1 - several vulnerabilities"); script_summary(english:"Checks dpkg output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Debian host is missing a security-related update." ); script_set_attribute( attribute:"description", value: "Various vulnerabilities were discovered in PostgreSQL : - CVE-2014-0060 Shore up GRANT ... WITH ADMIN OPTION restrictions (Noah Misch) Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions. - CVE-2014-0061 Prevent privilege escalation via manual calls to PL validator functions (Andres Freund) The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any. - CVE-2014-0062 Avoid multiple name lookups during table and index DDL (Robert Haas, Andres Freund) If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack. - CVE-2014-0063 Prevent buffer overrun with long datetime strings (Noah Misch) The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own. - CVE-2014-0064 CVE-2014-2669 Prevent buffer overrun due to integer overflow in size calculations (Noah Misch, Heikki Linnakangas) Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past. - CVE-2014-0065 Prevent overruns of fixed-size buffers (Peter Eisentraut, Jozef Mlich) Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type. - CVE-2014-0066 Avoid crashing if crypt() returns NULL (Honza Horak, Bruce Momjian) There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., 'FIPS mode'). - CVE-2014-0067 Document risks of make check in the regression testing instructions (Noah Misch, Tom Lane) Since the temporary server started by make check uses 'trust' authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine." ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0060" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0061" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0062" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0063" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0064" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-2669" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0065" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0066" ); script_set_attribute( attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-0067" ); script_set_attribute( attribute:"see_also", value:"https://packages.debian.org/source/wheezy/postgresql-9.1" ); script_set_attribute( attribute:"see_also", value:"https://www.debian.org/security/2014/dsa-2865" ); script_set_attribute( attribute:"solution", value: "Upgrade the postgresql-9.1 packages. For the stable distribution (wheezy), these problems have been fixed in version 9.1_9.1.12-0wheezy1." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-9.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/31"); script_set_attribute(attribute:"patch_publication_date", value:"2014/02/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/21"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Debian Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("debian_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian"); if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (deb_check(release:"7.0", prefix:"libecpg-compat3", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"libecpg-dev", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"libecpg6", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"libpgtypes3", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"libpq-dev", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"libpq5", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-9.1-dbg", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-client-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-contrib-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-doc-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-plperl-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-plpython-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-plpython3-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-pltcl-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (deb_check(release:"7.0", prefix:"postgresql-server-dev-9.1", reference:"9.1_9.1.12-0wheezy1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");
NASL family Databases NASL id POSTGRESQL_20140220.NASL description The version of PostgreSQL installed on the remote host is 8.4.x prior to 8.4.20, 9.0.x prior to 9.0.16, 9.1.x prior to 9.1.12, 9.2.x prior to 9.2.7 or 9.3.x prior to 9.3.3. It is, therefore, potentially affected by multiple vulnerabilities : - SET ROLE bypasses lack of ADMIN OPTION when granting roles. (CVE-2014-0060) - It is possible to elevate privileges via calls to validator functions. (CVE-2014-0061) - It is possible to elevate privileges via a race condition in CREATE INDEX. (CVE-2014-0062) - Potential buffer overruns exist due to integer overflow in size calculations. (CVE-2014-0063) - Potential buffer overruns exist in datetime input/output. (CVE-2014-0064) - Multiple fixed-size buffers exist that could potentially be overflowed. (CVE-2014-0065) - A potential NULL pointer dereference crash is possible when crypt(3) returns NULL. (CVE-2014-0066) - Multiple integer overflow vulnerabilities exist in last seen 2020-06-01 modified 2020-06-02 plugin id 72659 published 2014-02-24 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/72659 title PostgreSQL 8.4 < 8.4.20 / 9.0 < 9.0.16 / 9.1 < 9.1.12 / 9.2 < 9.2.7 / 9.3 < 9.3.3 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(72659); script_version("1.17"); script_cvs_date("Date: 2019/11/26"); script_cve_id( "CVE-2014-0060", "CVE-2014-0061", "CVE-2014-0062", "CVE-2014-0063", "CVE-2014-0064", "CVE-2014-0065", "CVE-2014-0066", "CVE-2014-2669" ); script_bugtraq_id( 65719, 65723, 65724, 65725, 65727, 65728, 65731, 66557 ); script_name(english:"PostgreSQL 8.4 < 8.4.20 / 9.0 < 9.0.16 / 9.1 < 9.1.12 / 9.2 < 9.2.7 / 9.3 < 9.3.3 Multiple Vulnerabilities"); script_summary(english:"Checks version of PostgreSQL"); script_set_attribute(attribute:"synopsis", value: "The remote database server is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of PostgreSQL installed on the remote host is 8.4.x prior to 8.4.20, 9.0.x prior to 9.0.16, 9.1.x prior to 9.1.12, 9.2.x prior to 9.2.7 or 9.3.x prior to 9.3.3. It is, therefore, potentially affected by multiple vulnerabilities : - SET ROLE bypasses lack of ADMIN OPTION when granting roles. (CVE-2014-0060) - It is possible to elevate privileges via calls to validator functions. (CVE-2014-0061) - It is possible to elevate privileges via a race condition in CREATE INDEX. (CVE-2014-0062) - Potential buffer overruns exist due to integer overflow in size calculations. (CVE-2014-0063) - Potential buffer overruns exist in datetime input/output. (CVE-2014-0064) - Multiple fixed-size buffers exist that could potentially be overflowed. (CVE-2014-0065) - A potential NULL pointer dereference crash is possible when crypt(3) returns NULL. (CVE-2014-0066) - Multiple integer overflow vulnerabilities exist in 'hstore_io.c' (CVE-2014-2669)"); script_set_attribute(attribute:"see_also", value:"https://www.postgresql.org/about/news/1506/"); script_set_attribute(attribute:"see_also", value:"http://www.postgresql.org/docs/8.4/static/release-8-4-20.html"); script_set_attribute(attribute:"see_also", value:"https://www.postgresql.org/docs/9.0/release-9-0-16.html"); script_set_attribute(attribute:"see_also", value:"https://www.postgresql.org/docs/9.1/release-9-1-12.html"); script_set_attribute(attribute:"see_also", value:"https://www.postgresql.org/docs/9.2/release-9-2-7.html"); script_set_attribute(attribute:"solution", value: "Upgrade to PostgreSQL 8.4.17 / 9.0.13 / 9.1.9 / 9.2.4 / 9.3.3 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-2669"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2014/02/20"); script_set_attribute(attribute:"patch_publication_date", value:"2014/02/20"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/24"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:postgresql:postgresql"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Databases"); script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("postgresql_version.nbin"); script_require_ports("Services/postgresql", 5432); exit(0); } include("audit.inc"); include("backport.inc"); include("global_settings.inc"); include("misc_func.inc"); port = get_service(svc:"postgresql", default:5432, exit_on_fail:TRUE); version = get_kb_item_or_exit('database/'+port+'/postgresql/version'); source = get_kb_item_or_exit('database/'+port+'/postgresql/source'); database = get_kb_item('database/'+port+'/postgresql/database_name'); get_backport_banner(banner:source); if (backported && report_paranoia < 2) audit(AUDIT_BACKPORT_SERVICE, port, 'PostgreSQL server'); ver = split(version, sep:'.'); for (i=0; i < max_index(ver); i++) ver[i] = int(ver[i]); if ( (ver[0] == 8 && ver[1] == 4 && ver[2] < 20) || (ver[0] == 9 && ver[1] == 0 && ver[2] < 16) || (ver[0] == 9 && ver[1] == 1 && ver[2] < 12) || (ver[0] == 9 && ver[1] == 2 && ver[2] < 7) || (ver[0] == 9 && ver[1] == 3 && ver[2] < 3) ) { if (report_verbosity > 0) { report = ''; if(database) report += '\n Database name : ' + database ; report += '\n Version source : ' + source + '\n Installed version : ' + version + '\n Fixed version : 8.4.20 / 9.0.16 / 9.1.12 / 9.2.7 / 9.3.3\n'; security_warning(port:port, extra:report); } else security_warning(port); exit(0); } else audit(AUDIT_LISTEN_NOT_VULN, 'PostgreSQL', port, version);
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201408-15.NASL description The remote host is affected by the vulnerability described in GLSA-201408-15 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote authenticated attacker may be able to create a Denial of Service condition, bypass security restrictions, or have other unspecified impact. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 77459 published 2014-08-30 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/77459 title GLSA-201408-15 : PostgreSQL: Multiple vulnerabilities code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201408-15. # # The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(77459); script_version("1.13"); script_cvs_date("Date: 2018/07/12 19:01:15"); script_cve_id("CVE-2013-0255", "CVE-2013-1899", "CVE-2013-1900", "CVE-2013-1901", "CVE-2014-0060", "CVE-2014-0061", "CVE-2014-0062", "CVE-2014-0063", "CVE-2014-0064", "CVE-2014-0065", "CVE-2014-0066", "CVE-2014-2669"); script_bugtraq_id(57844, 58876, 58878, 58879, 65719, 65723, 65724, 65725, 65727, 65728, 65731, 66557); script_xref(name:"GLSA", value:"201408-15"); script_name(english:"GLSA-201408-15 : PostgreSQL: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201408-15 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote authenticated attacker may be able to create a Denial of Service condition, bypass security restrictions, or have other unspecified impact. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201408-15" ); script_set_attribute( attribute:"solution", value: "All PostgreSQL 9.3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-9.3.3' All PostgreSQL 9.2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-9.2.7' All PostgreSQL 9.1 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-9.1.12' All PostgreSQL 9.0 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-9.0.16' All PostgreSQL 8.4 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-db/postgresql-server-8.4.20'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:postgresql-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2014/08/29"); script_set_attribute(attribute:"plugin_publication_date", value:"2014/08/30"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-db/postgresql-server", unaffected:make_list("ge 9.3.3", "rge 9.2.7", "rge 9.1.12", "rge 9.0.16", "rge 8.4.20"), vulnerable:make_list("lt 9.3.3"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PostgreSQL"); }
Redhat
advisories |
| ||||||||
rpms |
|
Seebug
bulletinFamily | exploit |
description | CVE ID:CVE-2014-2669 PostgreSQL是一款高级对象-关系型数据库管理系统,支持扩展的SQL标准子集。 PostgreSQL contrib/hstore/hstore_io.c存在整数溢出,允许远程通过验证的用户使应用程序崩溃。漏洞与hstore_recv, hstore_from_arrays和hstore_from_array函数相关。 0 PostgreSQL 9.0.x PostgreSQL 9.1.x PostgreSQL 9.2.x PostgreSQL 9.3.x PostgreSQL 9.0.16,9.1.12,9.2.7或9.3.3版本已修复该漏洞,建议用户下载使用: http://www.postgresql.org |
id | SSV:62016 |
last seen | 2017-11-19 |
modified | 2014-04-01 |
published | 2014-04-01 |
reporter | Root |
title | PostgreSQL contrib/hstore/hstore_io.c整数溢出漏洞 |
References
- http://rhn.redhat.com/errata/RHSA-2014-0221.html
- http://rhn.redhat.com/errata/RHSA-2014-0469.html
- http://wiki.postgresql.org/wiki/20140220securityrelease
- http://www.debian.org/security/2014/dsa-2864
- http://www.debian.org/security/2014/dsa-2865
- http://www.postgresql.org/about/news/1506/
- http://www.postgresql.org/support/security/
- https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a