Vulnerabilities > CVE-2015-0243 - Classic Buffer Overflow vulnerability in multiple products

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
postgresql
debian
CWE-120
nessus

Summary

Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

Vulnerable Configurations

Part Description Count
Application
Postgresql
272
OS
Debian
2

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-189.NASL
    descriptionpostgresql93 was updated to version 9.3.6 to fix four security issues. These security issues were fixed : - CVE-2015-0241: Fix buffer overruns in to_char() (bnc#916953). - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto (bnc#916953). - CVE-2015-0244: Fix possible loss of frontend/backend protocol synchronization after an error (bnc#916953). - CVE-2014-8161: Fix information leak via constraint-violation error messages (bnc#916953).
    last seen2020-06-05
    modified2015-03-05
    plugin id81620
    published2015-03-05
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81620
    titleopenSUSE Security Update : postgresql93 (openSUSE-2015-189)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2015-189.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81620);
      script_version("1.8");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2014-8161", "CVE-2015-0241", "CVE-2015-0243", "CVE-2015-0244");
    
      script_name(english:"openSUSE Security Update : postgresql93 (openSUSE-2015-189)");
      script_summary(english:"Check for the openSUSE-2015-189 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "postgresql93 was updated to version 9.3.6 to fix four security issues.
    
    These security issues were fixed :
    
      - CVE-2015-0241: Fix buffer overruns in to_char()
        (bnc#916953).
    
      - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto
        (bnc#916953).
    
      - CVE-2015-0244: Fix possible loss of frontend/backend
        protocol synchronization after an error (bnc#916953).
    
      - CVE-2014-8161: Fix information leak via
        constraint-violation error messages (bnc#916953)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=916953"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql93 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-contrib-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-libs-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plperl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plpython-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-pltcl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-server-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/02/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/05");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.2", reference:"libecpg6-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libecpg6-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libpq5-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libpq5-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-contrib-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-contrib-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-debugsource-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-devel-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-devel-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-libs-debugsource-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plperl-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plperl-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plpython-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plpython-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-pltcl-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-pltcl-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-server-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-server-debuginfo-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-test-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libecpg6-32bit-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libecpg6-debuginfo-32bit-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libpq5-32bit-9.3.6-2.4.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libpq5-debuginfo-32bit-9.3.6-2.4.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libecpg6-32bit / libecpg6 / libecpg6-debuginfo-32bit / etc");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-0750.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). An information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161) A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A stack-buffer overflow flaw was found in PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id82431
    published2015-03-31
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82431
    titleCentOS 6 / 7 : postgresql (CESA-2015:0750)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:0750 and 
    # CentOS Errata and Security Advisory 2015:0750 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(82431);
      script_version("1.11");
      script_cvs_date("Date: 2020/02/03");
    
      script_cve_id("CVE-2014-8161", "CVE-2015-0241", "CVE-2015-0243", "CVE-2015-0244");
      script_xref(name:"RHSA", value:"2015:0750");
    
      script_name(english:"CentOS 6 / 7 : postgresql (CESA-2015:0750)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated postgresql packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6 and 7.
    
    Red Hat Product Security has rated this update as having Moderate
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    PostgreSQL is an advanced object-relational database management system
    (DBMS).
    
    An information leak flaw was found in the way the PostgreSQL database
    server handled certain error messages. An authenticated database user
    could possibly obtain the results of a query they did not have
    privileges to execute by observing the constraint violation error
    messages produced when the query was executed. (CVE-2014-8161)
    
    A buffer overflow flaw was found in the way PostgreSQL handled certain
    numeric formatting. An authenticated database user could use a
    specially crafted timestamp formatting template to cause PostgreSQL to
    crash or, under certain conditions, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0241)
    
    A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto
    module. An authenticated database user could use this flaw to cause
    PostgreSQL to crash or, potentially, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0243)
    
    A flaw was found in the way PostgreSQL handled certain errors that
    were generated during protocol synchronization. An authenticated
    database user could use this flaw to inject queries into an existing
    connection. (CVE-2015-0244)
    
    Red Hat would like to thank the PostgreSQL project for reporting these
    issues. Upstream acknowledges Stephen Frost as the original reporter
    of CVE-2014-8161; Andres Freund, Peter Geoghegan, Bernd Helmle, and
    Noah Misch as the original reporters of CVE-2015-0241; Marko Tiikkaja
    as the original reporter of CVE-2015-0243; and Emil Lenngren as the
    original reporter of CVE-2015-0244.
    
    All PostgreSQL users are advised to upgrade to these updated packages,
    which contain backported patches to correct these issues. If the
    postgresql service is running, it will be automatically restarted
    after installing this update."
      );
      # https://lists.centos.org/pipermail/centos-announce/2015-April/021032.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?03ec7a72"
      );
      # https://lists.centos.org/pipermail/centos-announce/2015-March/021003.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?15b880d8"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-0244");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:postgresql-upgrade");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/03/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 6.x / 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-contrib-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-devel-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-docs-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-libs-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-plperl-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-plpython-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-pltcl-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-server-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"postgresql-test-8.4.20-2.el6_6")) flag++;
    
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-contrib-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-devel-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-docs-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-libs-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-plperl-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-plpython-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-pltcl-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-server-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-test-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"postgresql-upgrade-9.2.10-2.el7_1")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-0478-1.NASL
    descriptionpostgresql93 was updated to version 9.3.6 to fix four security issues. These security issues were fixed : - CVE-2015-0241: Fix buffer overruns in to_char() (bnc#916953). - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto (bnc#916953). - CVE-2015-0244: Fix possible loss of frontend/backend protocol synchronization after an error (bnc#916953). - CVE-2014-8161: Fix information leak via constraint-violation error messages (bnc#916953). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id83695
    published2015-05-20
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83695
    titleSUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:0478-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2015:0478-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(83695);
      script_version("2.15");
      script_cvs_date("Date: 2020/02/03");
    
      script_cve_id("CVE-2014-8161", "CVE-2015-0241", "CVE-2015-0243", "CVE-2015-0244");
      script_bugtraq_id(72538, 72540, 72542, 72543);
    
      script_name(english:"SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:0478-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "postgresql93 was updated to version 9.3.6 to fix four security issues.
    
    These security issues were fixed :
    
      - CVE-2015-0241: Fix buffer overruns in to_char()
        (bnc#916953).
    
      - CVE-2015-0243: Fix buffer overruns in contrib/pgcrypto
        (bnc#916953).
    
      - CVE-2015-0244: Fix possible loss of frontend/backend
        protocol synchronization after an error (bnc#916953).
    
      - CVE-2014-8161: Fix information leak via
        constraint-violation error messages (bnc#916953).
    
    The update package also includes non-security fixes. See advisory for
    details.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=888564"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=916953"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2014-8161/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-0241/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-0243/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-0244/"
      );
      # https://www.suse.com/support/update/announcement/2015/suse-su-20150478-1.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4bc90551"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Software Development Kit 12 :
    
    zypper in -t patch SUSE-SLE-SDK-12-2015-118=1
    
    SUSE Linux Enterprise Server 12 :
    
    zypper in -t patch SUSE-SLE-SERVER-12-2015-118=1
    
    SUSE Linux Enterprise Desktop 12 :
    
    zypper in -t patch SUSE-SLE-DESKTOP-12-2015-118=1
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libecpg6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libecpg6-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpq5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libpq5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93-contrib-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93-libs-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql93-server-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/02/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0", os_ver + " SP" + sp);
    if (os_ver == "SLED12" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP0", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libecpg6-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libecpg6-debuginfo-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libpq5-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libpq5-debuginfo-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-contrib-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-contrib-debuginfo-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-debuginfo-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-debugsource-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-libs-debugsource-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-server-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"postgresql93-server-debuginfo-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libpq5-32bit-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"0", reference:"libpq5-debuginfo-32bit-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libecpg6-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libecpg6-debuginfo-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libpq5-32bit-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libpq5-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libpq5-debuginfo-32bit-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"libpq5-debuginfo-9.3.6-5.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"postgresql93-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"postgresql93-debuginfo-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"postgresql93-debugsource-9.3.6-5.2")) flag++;
    if (rpm_check(release:"SLED12", sp:"0", cpu:"x86_64", reference:"postgresql93-libs-debugsource-9.3.6-5.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql93");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-0750.NASL
    descriptionFrom Red Hat Security Advisory 2015:0750 : Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). An information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161) A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A stack-buffer overflow flaw was found in PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id82465
    published2015-03-31
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82465
    titleOracle Linux 6 / 7 : postgresql (ELSA-2015-0750)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2015:0750 and 
    # Oracle Linux Security Advisory ELSA-2015-0750 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(82465);
      script_version("1.14");
      script_cvs_date("Date: 2020/02/03");
    
      script_cve_id("CVE-2014-8161", "CVE-2015-0241", "CVE-2015-0243", "CVE-2015-0244");
      script_xref(name:"RHSA", value:"2015:0750");
    
      script_name(english:"Oracle Linux 6 / 7 : postgresql (ELSA-2015-0750)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2015:0750 :
    
    Updated postgresql packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6 and 7.
    
    Red Hat Product Security has rated this update as having Moderate
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    PostgreSQL is an advanced object-relational database management system
    (DBMS).
    
    An information leak flaw was found in the way the PostgreSQL database
    server handled certain error messages. An authenticated database user
    could possibly obtain the results of a query they did not have
    privileges to execute by observing the constraint violation error
    messages produced when the query was executed. (CVE-2014-8161)
    
    A buffer overflow flaw was found in the way PostgreSQL handled certain
    numeric formatting. An authenticated database user could use a
    specially crafted timestamp formatting template to cause PostgreSQL to
    crash or, under certain conditions, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0241)
    
    A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto
    module. An authenticated database user could use this flaw to cause
    PostgreSQL to crash or, potentially, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0243)
    
    A flaw was found in the way PostgreSQL handled certain errors that
    were generated during protocol synchronization. An authenticated
    database user could use this flaw to inject queries into an existing
    connection. (CVE-2015-0244)
    
    Red Hat would like to thank the PostgreSQL project for reporting these
    issues. Upstream acknowledges Stephen Frost as the original reporter
    of CVE-2014-8161; Andres Freund, Peter Geoghegan, Bernd Helmle, and
    Noah Misch as the original reporters of CVE-2015-0241; Marko Tiikkaja
    as the original reporter of CVE-2015-0243; and Emil Lenngren as the
    original reporter of CVE-2015-0244.
    
    All PostgreSQL users are advised to upgrade to these updated packages,
    which contain backported patches to correct these issues. If the
    postgresql service is running, it will be automatically restarted
    after installing this update."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2015-March/004956.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2015-March/004958.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:postgresql-upgrade");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/03/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6 / 7", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"postgresql-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-contrib-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-devel-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-docs-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-libs-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-plperl-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-plpython-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-pltcl-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-server-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"EL6", reference:"postgresql-test-8.4.20-2.el6_6")) flag++;
    
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-contrib-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-devel-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-docs-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-libs-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-plperl-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-plpython-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-pltcl-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-server-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-test-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"postgresql-upgrade-9.2.10-2.el7_1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-devel / etc");
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20150330_POSTGRESQL_ON_SL6_X.NASL
    descriptionAn information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161) A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A stack-buffer overflow flaw was found in PostgreSQL
    last seen2020-03-18
    modified2015-03-31
    plugin id82469
    published2015-03-31
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82469
    titleScientific Linux Security Update : postgresql on SL6.x, SL7.x i386/x86_64 (20150330)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(82469);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/25");
    
      script_cve_id("CVE-2014-8161", "CVE-2015-0241", "CVE-2015-0243", "CVE-2015-0244");
    
      script_name(english:"Scientific Linux Security Update : postgresql on SL6.x, SL7.x i386/x86_64 (20150330)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An information leak flaw was found in the way the PostgreSQL database
    server handled certain error messages. An authenticated database user
    could possibly obtain the results of a query they did not have
    privileges to execute by observing the constraint violation error
    messages produced when the query was executed. (CVE-2014-8161)
    
    A buffer overflow flaw was found in the way PostgreSQL handled certain
    numeric formatting. An authenticated database user could use a
    specially crafted timestamp formatting template to cause PostgreSQL to
    crash or, under certain conditions, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0241)
    
    A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto
    module. An authenticated database user could use this flaw to cause
    PostgreSQL to crash or, potentially, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0243)
    
    A flaw was found in the way PostgreSQL handled certain errors that
    were generated during protocol synchronization. An authenticated
    database user could use this flaw to inject queries into an existing
    connection. (CVE-2015-0244)
    
    If the postgresql service is running, it will be automatically
    restarted after installing this update."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1503&L=scientific-linux-errata&T=0&P=4261
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?6566d786"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-upgrade");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/03/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL6", reference:"postgresql-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-contrib-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-debuginfo-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-devel-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-docs-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-libs-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-plperl-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-plpython-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-pltcl-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-server-8.4.20-2.el6_6")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-test-8.4.20-2.el6_6")) flag++;
    
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-contrib-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-debuginfo-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-devel-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-docs-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-libs-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-plperl-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-plpython-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-pltcl-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-server-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-test-9.2.10-2.el7_1")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"postgresql-upgrade-9.2.10-2.el7_1")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-debuginfo / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-0750.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). An information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161) A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A stack-buffer overflow flaw was found in PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id82466
    published2015-03-31
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82466
    titleRHEL 6 / 7 : postgresql (RHSA-2015:0750)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2015:0750. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(82466);
      script_version("1.16");
      script_cvs_date("Date: 2020/02/03");
    
      script_cve_id("CVE-2014-8161", "CVE-2015-0241", "CVE-2015-0243", "CVE-2015-0244");
      script_xref(name:"RHSA", value:"2015:0750");
    
      script_name(english:"RHEL 6 / 7 : postgresql (RHSA-2015:0750)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated postgresql packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6 and 7.
    
    Red Hat Product Security has rated this update as having Moderate
    security impact. Common Vulnerability Scoring System (CVSS) base
    scores, which give detailed severity ratings, are available for each
    vulnerability from the CVE links in the References section.
    
    PostgreSQL is an advanced object-relational database management system
    (DBMS).
    
    An information leak flaw was found in the way the PostgreSQL database
    server handled certain error messages. An authenticated database user
    could possibly obtain the results of a query they did not have
    privileges to execute by observing the constraint violation error
    messages produced when the query was executed. (CVE-2014-8161)
    
    A buffer overflow flaw was found in the way PostgreSQL handled certain
    numeric formatting. An authenticated database user could use a
    specially crafted timestamp formatting template to cause PostgreSQL to
    crash or, under certain conditions, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0241)
    
    A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto
    module. An authenticated database user could use this flaw to cause
    PostgreSQL to crash or, potentially, execute arbitrary code with the
    permissions of the user running PostgreSQL. (CVE-2015-0243)
    
    A flaw was found in the way PostgreSQL handled certain errors that
    were generated during protocol synchronization. An authenticated
    database user could use this flaw to inject queries into an existing
    connection. (CVE-2015-0244)
    
    Red Hat would like to thank the PostgreSQL project for reporting these
    issues. Upstream acknowledges Stephen Frost as the original reporter
    of CVE-2014-8161; Andres Freund, Peter Geoghegan, Bernd Helmle, and
    Noah Misch as the original reporters of CVE-2015-0241; Marko Tiikkaja
    as the original reporter of CVE-2015-0243; and Emil Lenngren as the
    original reporter of CVE-2015-0244.
    
    All PostgreSQL users are advised to upgrade to these updated packages,
    which contain backported patches to correct these issues. If the
    postgresql service is running, it will be automatically restarted
    after installing this update."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2015:0750"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-0244"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2014-8161"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-0241"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2015-0243"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:postgresql-upgrade");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/03/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/03/31");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x / 7.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2015:0750";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", reference:"postgresql-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-contrib-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-contrib-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-contrib-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"postgresql-debuginfo-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"postgresql-devel-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-docs-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-docs-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-docs-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", reference:"postgresql-libs-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-plperl-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-plperl-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-plperl-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-plpython-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-plpython-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-plpython-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-pltcl-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-pltcl-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-pltcl-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-server-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-server-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-server-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"postgresql-test-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"postgresql-test-8.4.20-2.el6_6")) flag++;
    
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"postgresql-test-8.4.20-2.el6_6")) flag++;
    
    
      if (rpm_check(release:"RHEL7", reference:"postgresql-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-contrib-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-contrib-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"postgresql-debuginfo-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"postgresql-devel-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-docs-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-docs-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", reference:"postgresql-libs-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-plperl-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-plperl-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-plpython-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-plpython-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-pltcl-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-pltcl-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-server-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-server-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-test-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-test-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"s390x", reference:"postgresql-upgrade-9.2.10-2.el7_1")) flag++;
    
      if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"postgresql-upgrade-9.2.10-2.el7_1")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-debuginfo / etc");
      }
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-1745.NASL
    descriptionupdate to 9.3.6 per release notes http://www.postgresql.org/docs/9.3/static/release-9-3-6.html, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2015-02-09
    plugin id81220
    published2015-02-09
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81220
    titleFedora 21 : postgresql-9.3.6-1.fc21 (2015-1745)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2015-1745.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81220);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_xref(name:"FEDORA", value:"2015-1745");
    
      script_name(english:"Fedora 21 : postgresql-9.3.6-1.fc21 (2015-1745)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "update to 9.3.6 per release notes
    http://www.postgresql.org/docs/9.3/static/release-9-3-6.html,
    CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://www.postgresql.org/docs/9.3/static/release-9-3-6.html,
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/9.3/static/release-9-3-6.html,/"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-February/149411.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?05d0fd7a"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql package."
      );
      script_set_attribute(attribute:"risk_factor", value:"High");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:postgresql");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:21");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/02/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/09");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^21([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 21.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC21", reference:"postgresql-9.3.6-1.fc21")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-152.NASL
    descriptionSeveral vulnerabilities were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS minor version contains the fixes that were applied upstream to the 9.0.19 version, backported to 8.4.22 which was the last version officially released by the PostgreSQL developers. This LTS effort for squeeze-lts is a community project sponsored by credativ GmbH. CVE-2014-8161: Information leak A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages. CVE-2015-0241: Out of boundaries read/write The function to_char() might read/write past the end of a buffer. This might crash the server when a formatting template is processed. CVE-2015-0243: Buffer overruns in contrib/pgcrypto The pgcrypto module is vulnerable to stack buffer overrun that might crash the server. CVE-2015-0244: SQL command injection Emil Lenngren reported that an attacker can inject SQL commands when the synchronization between client and server is lost. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2015-03-26
    plugin id82135
    published2015-03-26
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82135
    titleDebian DLA-152-1 : postgresql-8.4 update
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-503.NASL
    descriptionAn information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161) A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A stack-buffer overflow flaw was found in PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id82831
    published2015-04-17
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82831
    titleAmazon Linux AMI : postgresql8 (ALAS-2015-503)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-485.NASL
    descriptionA stack-buffer overflow flaw was found in PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id81673
    published2015-03-09
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81673
    titleAmazon Linux AMI : postgresql93 (ALAS-2015-485)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-1728.NASL
    descriptionupdate to 9.3.6 per release notes http://www.postgresql.org/docs/9.3/static/release-9-3-6.html, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2015-02-16
    plugin id81357
    published2015-02-16
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81357
    titleFedora 20 : postgresql-9.3.6-1.fc20 (2015-1728)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201507-20.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201507-20 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition or escalate privileges. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id84863
    published2015-07-20
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84863
    titleGLSA-201507-20 : PostgreSQL: Multiple vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_10_5.NASL
    descriptionThe remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - Apple ID OD Plug-in - AppleGraphicsControl - Bluetooth - bootp - CloudKit - CoreMedia Playback - CoreText - curl - Data Detectors Engine - Date & Time pref pane - Dictionary Application - DiskImages - dyld - FontParser - groff - ImageIO - Install Framework Legacy - IOFireWireFamily - IOGraphics - IOHIDFamily - Kernel - Libc - Libinfo - libpthread - libxml2 - libxpc - mail_cmds - Notification Center OSX - ntfs - OpenSSH - OpenSSL - perl - PostgreSQL - python - QL Office - Quartz Composer Framework - Quick Look - QuickTime 7 - SceneKit - Security - SMBClient - Speech UI - sudo - tcpdump - Text Formats - udf Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id85408
    published2015-08-17
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/85408
    titleMac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_POSTGRESQL91-201503-150302.NASL
    descriptionThe PostgreSQL database server was updated to 9.1.15, fixing bugs and security issues : - Fix buffer overruns in to_char(). (CVE-2015-0241) - Fix buffer overrun in replacement *printf() functions. (CVE-2015-0242) - Fix buffer overruns in contrib/pgcrypto. (CVE-2015-0243) - Fix possible loss of frontend/backend protocol synchronization after an error. (CVE-2015-0244) - Fix information leak via constraint-violation error messages (CVE-2014-8161). For a comprehensive list of fixes, please refer to the following release notes : - http://www.postgresql.org/docs/9.1/static/release-9-1-15 .html - http://www.postgresql.org/docs/9.1/static/release-9-1-14 .html - http://www.postgresql.org/docs/9.1/static/release-9-1-13 .html
    last seen2020-06-01
    modified2020-06-02
    plugin id82470
    published2015-03-31
    reporterThis script is Copyright (C) 2015 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/82470
    titleSuSE 11.3 Security Update : postgresql91 (SAT Patch Number 10389)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3155.NASL
    descriptionSeveral vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. - CVE-2014-8161: Information leak A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages. - CVE-2015-0241: Out of boundaries read/write The function to_char() might read/write past the end of a buffer. This might crash the server when a formatting template is processed. - CVE-2015-0243: Buffer overruns in contrib/pgcrypto The pgcrypto module is vulnerable to stack buffer overrun that might crash the server. - CVE-2015-0244: SQL command injection Emil Lenngren reported that an attacker can inject SQL commands when the synchronization between client and server is lost.
    last seen2020-03-17
    modified2015-02-09
    plugin id81211
    published2015-02-09
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81211
    titleDebian DSA-3155-1 : postgresql-9.1 - security update
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2015-006.NASL
    descriptionThe remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - CoreText - FontParser - Libinfo - libxml2 - OpenSSL - perl - PostgreSQL - QL Office - Quartz Composer Framework - QuickTime 7 - SceneKit Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id85409
    published2015-08-17
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/85409
    titleMac OS X Multiple Vulnerabilities (Security Update 2015-006)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SERVER_5_0_3.NASL
    descriptionThe remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the mod_headers module that allows HTTP trailers to replace HTTP headers late during request processing. A remote attacker can exploit this to inject arbitrary headers. This can also cause some modules to function incorrectly or appear to function incorrectly. (CVE-2013-5704) - A privilege escalation vulnerability exists due to the
    last seen2020-06-01
    modified2020-06-02
    plugin id86066
    published2015-09-22
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86066
    titleMac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_3B40BF2CAD8311E4A2B20026551A22DC.NASL
    descriptionPostgreSQL Project reports : This update fixes multiple security issues reported in PostgreSQL over the past few months. All of these issues require prior authentication, and some require additional conditions, and as such are not considered generally urgent. However, users should examine the list of security holes patched below in case they are particularly vulnerable. - CVE-2015-0241 Buffer overruns in
    last seen2020-06-01
    modified2020-06-02
    plugin id81193
    published2015-02-06
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81193
    titleFreeBSD : PostgreSQL -- multiple buffer overflows and memory issues (3b40bf2c-ad83-11e4-a2b2-0026551a22dc)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2015-048.NASL
    descriptionMultiple vulnerabilities has been discovered and corrected in postgresql : Stephen Frost discovered that PostgreSQL incorrectly displayed certain values in error messages. An authenticated user could gain access to seeing certain values, contrary to expected permissions (CVE-2014-8161). Andres Freund, Peter Geoghegan and Noah Misch discovered that PostgreSQL incorrectly handled buffers in to_char functions. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-0241). It was discovered that PostgreSQL incorrectly handled memory in the pgcrypto extension. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-0243). Emil Lenngren discovered that PostgreSQL incorrectly handled extended protocol message reading. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly inject query messages (CVE-2015-0244). This advisory provides the latest version of PostgreSQL that is not vulnerable to these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id81337
    published2015-02-13
    reporterThis script is Copyright (C) 2015-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/81337
    titleMandriva Linux Security Advisory : postgresql (MDVSA-2015:048)
  • NASL familyDatabases
    NASL idPOSTGRESQL_20150205.NASL
    descriptionThe version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.19, 9.1.x prior to 9.1.15, 9.2.x prior to 9.2.10, 9.3.x prior to 9.3.6, or 9.4.x prior to 9.4.1. It is, therefore, affected by multiple vulnerabilities : - A privilege escalation vulnerability exists due to the
    last seen2020-06-01
    modified2020-06-02
    plugin id81300
    published2015-02-11
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81300
    titlePostgreSQL 9.0 < 9.0.19 / 9.1 < 9.1.15 / 9.2 < 9.2.10 / 9.3 < 9.3.6 / 9.4 < 9.4.1 Multiple Vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2499-1.NASL
    descriptionStephen Frost discovered that PostgreSQL incorrectly displayed certain values in error messages. An authenticated user could gain access to seeing certain values, contrary to expected permissions. (CVE-2014-8161) Andres Freund, Peter Geoghegan and Noah Misch discovered that PostgreSQL incorrectly handled buffers in to_char functions. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-0241) It was discovered that PostgreSQL incorrectly handled memory in the pgcrypto extension. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-0243) Emil Lenngren discovered that PostgreSQL incorrectly handled extended protocol message reading. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly inject query messages. (CVE-2015-0244). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id81314
    published2015-02-12
    reporterUbuntu Security Notice (C) 2015-2020 Canonical, Inc. / NASL script (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81314
    titleUbuntu 10.04 LTS / 12.04 LTS / 14.04 LTS / 14.10 : postgresql-8.4, postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities (USN-2499-1)
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2015-110.NASL
    descriptionUpdated postgresql packages fix multiple security vulnerabilities : Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions (CVE-2014-0060). The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function. Non-core procedural languages will also need to make this change to their own validator functions, if any (CVE-2014-0061). If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack (CVE-2014-0062). The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out(). Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name. The ecpg library contained these vulnerabilities along with some of its own (CVE-2014-0063). Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past (CVE-2014-0064). Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type (CVE-2014-0065). There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., FIPS mode) (CVE-2014-0066). Since the temporary server started by make check uses trust authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine (CVE-2014-0067). A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages (CVE-2014-8161). The function to_char() might read/write past the end of a buffer. This might crash the server when a formatting template is processed (CVE-2015-0241). The pgcrypto module is vulnerable to stack buffer overrun that might crash the server (CVE-2015-0243). Emil Lenngren reported that an attacker can inject SQL commands when the synchronization between client and server is lost (CVE-2015-0244). This update provides PostgreSQL versions 9.3.6 and 9.2.10 that fix these issues, as well as several others.
    last seen2020-06-01
    modified2020-06-02
    plugin id82363
    published2015-03-30
    reporterThis script is Copyright (C) 2015-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/82363
    titleMandriva Linux Security Advisory : postgresql (MDVSA-2015:110)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-0856.NASL
    descriptionUpdated postgresql packages that fix multiple security issues are now available for Red Hat Satellite 5.7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). An information leak flaw was found in the way the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161) A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A stack-buffer overflow flaw was found in PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id82908
    published2015-04-21
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/82908
    titleRHEL 6 : postgresql92-postgresql (RHSA-2015:0856)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-492.NASL
    descriptionA buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241) A buffer overflow flaw was found in the PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id81828
    published2015-03-17
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81828
    titleAmazon Linux AMI : postgresql92 (ALAS-2015-492)

Redhat

rpms
  • postgresql92-postgresql-0:9.2.10-1.el7
  • postgresql92-postgresql-0:9.2.10-2.el6
  • postgresql92-postgresql-contrib-0:9.2.10-1.el7
  • postgresql92-postgresql-contrib-0:9.2.10-2.el6
  • postgresql92-postgresql-debuginfo-0:9.2.10-1.el7
  • postgresql92-postgresql-debuginfo-0:9.2.10-2.el6
  • postgresql92-postgresql-devel-0:9.2.10-1.el7
  • postgresql92-postgresql-devel-0:9.2.10-2.el6
  • postgresql92-postgresql-docs-0:9.2.10-1.el7
  • postgresql92-postgresql-docs-0:9.2.10-2.el6
  • postgresql92-postgresql-libs-0:9.2.10-1.el7
  • postgresql92-postgresql-libs-0:9.2.10-2.el6
  • postgresql92-postgresql-plperl-0:9.2.10-1.el7
  • postgresql92-postgresql-plperl-0:9.2.10-2.el6
  • postgresql92-postgresql-plpython-0:9.2.10-1.el7
  • postgresql92-postgresql-plpython-0:9.2.10-2.el6
  • postgresql92-postgresql-pltcl-0:9.2.10-1.el7
  • postgresql92-postgresql-pltcl-0:9.2.10-2.el6
  • postgresql92-postgresql-server-0:9.2.10-1.el7
  • postgresql92-postgresql-server-0:9.2.10-2.el6
  • postgresql92-postgresql-test-0:9.2.10-1.el7
  • postgresql92-postgresql-test-0:9.2.10-2.el6
  • postgresql92-postgresql-upgrade-0:9.2.10-1.el7
  • postgresql92-postgresql-upgrade-0:9.2.10-2.el6
  • postgresql-0:8.4.20-2.el6_6
  • postgresql-0:9.2.10-2.ael7b_1
  • postgresql-0:9.2.10-2.el7_1
  • postgresql-contrib-0:8.4.20-2.el6_6
  • postgresql-contrib-0:9.2.10-2.ael7b_1
  • postgresql-contrib-0:9.2.10-2.el7_1
  • postgresql-debuginfo-0:8.4.20-2.el6_6
  • postgresql-debuginfo-0:9.2.10-2.ael7b_1
  • postgresql-debuginfo-0:9.2.10-2.el7_1
  • postgresql-devel-0:8.4.20-2.el6_6
  • postgresql-devel-0:9.2.10-2.ael7b_1
  • postgresql-devel-0:9.2.10-2.el7_1
  • postgresql-docs-0:8.4.20-2.el6_6
  • postgresql-docs-0:9.2.10-2.ael7b_1
  • postgresql-docs-0:9.2.10-2.el7_1
  • postgresql-libs-0:8.4.20-2.el6_6
  • postgresql-libs-0:9.2.10-2.ael7b_1
  • postgresql-libs-0:9.2.10-2.el7_1
  • postgresql-plperl-0:8.4.20-2.el6_6
  • postgresql-plperl-0:9.2.10-2.ael7b_1
  • postgresql-plperl-0:9.2.10-2.el7_1
  • postgresql-plpython-0:8.4.20-2.el6_6
  • postgresql-plpython-0:9.2.10-2.ael7b_1
  • postgresql-plpython-0:9.2.10-2.el7_1
  • postgresql-pltcl-0:8.4.20-2.el6_6
  • postgresql-pltcl-0:9.2.10-2.ael7b_1
  • postgresql-pltcl-0:9.2.10-2.el7_1
  • postgresql-server-0:8.4.20-2.el6_6
  • postgresql-server-0:9.2.10-2.ael7b_1
  • postgresql-server-0:9.2.10-2.el7_1
  • postgresql-test-0:8.4.20-2.el6_6
  • postgresql-test-0:9.2.10-2.ael7b_1
  • postgresql-test-0:9.2.10-2.el7_1
  • postgresql-upgrade-0:9.2.10-2.ael7b_1
  • postgresql-upgrade-0:9.2.10-2.el7_1
  • postgresql92-postgresql-0:9.2.10-2.el6
  • postgresql92-postgresql-contrib-0:9.2.10-2.el6
  • postgresql92-postgresql-debuginfo-0:9.2.10-2.el6
  • postgresql92-postgresql-libs-0:9.2.10-2.el6
  • postgresql92-postgresql-pltcl-0:9.2.10-2.el6
  • postgresql92-postgresql-server-0:9.2.10-2.el6
  • postgresql92-postgresql-upgrade-0:9.2.10-2.el6