Vulnerabilities > CVE-2015-3165 - Remote Denial Of Service vulnerability in PostgreSQL

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL

Summary

Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a>

Vulnerable Configurations

Part Description Count
OS
Canonical
4
OS
Debian
2
OS
Apple
1
Application
Postgresql
277

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-1091-1.NASL
    descriptionThis update provides PostgreSQL 9.1.18, which brings fixes for security issues and other enhancements. The following vulnerabilities have been fixed : CVE-2015-3165: Avoid possible crash when client disconnects. (bsc#931972) CVE-2015-3166: Consistently check for failure of the *printf(). (bsc#931973) CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption failures. (bsc#931974) For a comprehensive list of changes, please refer to <a href=
    last seen2020-06-01
    modified2020-06-02
    plugin id84338
    published2015-06-23
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84338
    titleSUSE SLED11 / SLES11 Security Update : postgresql91 (SUSE-SU-2015:1091-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2015:1091-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84338);
      script_version("2.18");
      script_cvs_date("Date: 2019/11/25");
    
      script_cve_id("CVE-2015-3165", "CVE-2015-3166", "CVE-2015-3167");
      script_bugtraq_id(74787, 74789, 74790);
    
      script_name(english:"SUSE SLED11 / SLES11 Security Update : postgresql91 (SUSE-SU-2015:1091-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update provides PostgreSQL 9.1.18, which brings fixes for
    security issues and other enhancements.
    
    The following vulnerabilities have been fixed :
    
    CVE-2015-3165: Avoid possible crash when client disconnects.
    (bsc#931972)
    
    CVE-2015-3166: Consistently check for failure of the *printf().
    (bsc#931973)
    
    CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption
    failures. (bsc#931974)
    
    For a comprehensive list of changes, please refer to <a
    href='http://www.postgresql.org/docs/9.1/static/release-9-1-18.html'>h
    ttp://www.postgresql.org/docs/9.1/static/release-9-1-18.html</a>.
    
    This update also includes changes in PostgreSQL's packaging to prepare
    for the migration to the new major version 9.4. (FATE#316970,
    bsc#907651)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://www.postgresql.org/docs/9.1/static/release-9-1-18.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/9.1/release-9-1-18.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=907651"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=931972"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=931973"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=931974"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=932040"
      );
      # https://download.suse.com/patch/finder/?keywords=00fcb88ab431584bc7bf32ba75396dee
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?36f6d275"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-3165/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-3166/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-3167/"
      );
      # https://www.suse.com/support/update/announcement/2015/suse-su-20151091-1.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?23fcfb6c"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Manager Server :
    
    zypper in -t patch sleman21-postgresql91-201505=10760
    
    SUSE Linux Enterprise Software Development Kit 11 SP3 :
    
    zypper in -t patch sdksp3-postgresql91-201505=10760
    
    SUSE Linux Enterprise Server 11 SP3 for VMware :
    
    zypper in -t patch slessp3-postgresql91-201505=10760
    
    SUSE Linux Enterprise Server 11 SP3 :
    
    zypper in -t patch slessp3-postgresql91-201505=10760
    
    SUSE Linux Enterprise Desktop 11 SP3 :
    
    zypper in -t patch sledsp3-postgresql91-201505=10760
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91-server");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/05/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/06/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/06/23");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED11|SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED11 / SLES11", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES11" && (! preg(pattern:"^(3)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP3", os_ver + " SP" + sp);
    if (os_ver == "SLED11" && (! preg(pattern:"^(3)$", string:sp))) audit(AUDIT_OS_NOT, "SLED11 SP3", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-9.1.18-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-contrib-9.1.18-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-docs-9.1.18-0.3.1")) flag++;
    if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-server-9.1.18-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"x86_64", reference:"postgresql91-9.1.18-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"x86_64", reference:"postgresql91-docs-9.1.18-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"i586", reference:"postgresql91-9.1.18-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:"3", cpu:"i586", reference:"postgresql91-docs-9.1.18-0.3.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql91");
    }
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-556.NASL
    descriptionA double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167)
    last seen2020-06-01
    modified2020-06-02
    plugin id84592
    published2015-07-08
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84592
    titleAmazon Linux AMI : postgresql8 (ALAS-2015-556)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2015-556.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(84592);
      script_version("2.6");
      script_cvs_date("Date: 2019/11/25");
    
      script_cve_id("CVE-2015-3165", "CVE-2015-3166", "CVE-2015-3167");
      script_xref(name:"ALAS", value:"2015-556");
      script_xref(name:"RHSA", value:"2015:1194");
    
      script_name(english:"Amazon Linux AMI : postgresql8 (ALAS-2015-556)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A double-free flaw was found in the connection handling. An
    unauthenticated attacker could exploit this flaw to crash the
    PostgreSQL back end by disconnecting at approximately the same time as
    the authentication time out is triggered. (CVE-2015-3165)
    
    It was discovered that PostgreSQL did not properly check the return
    values of certain standard library functions. If the system is in a
    state that would cause the standard library functions to fail, for
    example memory exhaustion, an authenticated user could exploit this
    flaw to disclose partial memory contents or cause the GSSAPI
    authentication to use an incorrect keytab file. (CVE-2015-3166)
    
    It was discovered that the pgcrypto module could return different
    error messages when decrypting certain data with an incorrect key.
    This can help an authenticated user to launch a possible cryptographic
    attack, although no suitable attack is currently known.
    (CVE-2015-3167)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2015-556.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update postgresql8' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/05/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/07/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/08");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"postgresql8-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-contrib-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-debuginfo-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-devel-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-docs-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-libs-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-plperl-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-plpython-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-pltcl-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-server-8.4.20-3.50.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-test-8.4.20-3.50.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql8 / postgresql8-contrib / postgresql8-debuginfo / etc");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-227.NASL
    descriptionSeveral vulnerabilities were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS minor version contains the fixes that were applied upstream to the 9.0.20 version, backported to 8.4.22 which was the last version officially released by the PostgreSQL developers. This LTS effort for squeeze-lts is a community project sponsored by credativ GmbH. CVE-2015-3165: Remote crash SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. CVE-2015-3166: Information exposure The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. CVE-2015-3167: Possible side-channel key exposure In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message. Note that the next round of minor releases for PostgreSQL have already been scheduled for early June 2015. There will be a corresponding 8.4.22lts3 update at the same time. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2015-06-01
    plugin id83905
    published2015-06-01
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83905
    titleDebian DLA-227-1 : postgresql-8.4 update
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-545.NASL
    descriptionDouble free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
    last seen2020-06-01
    modified2020-06-02
    plugin id84246
    published2015-06-18
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/84246
    titleAmazon Linux AMI : postgresql92 (ALAS-2015-545)
  • NASL familyCGI abuses
    NASL idPUPPET_ENTERPRISE_ACTIVEMQ_PSQL_SSL.NASL
    descriptionAccording to its self-reported version number, the Puppet Enterprise application running on the remote host is 3.x prior to 3.8.1. It is, therefore, affected by the following vulnerabilities : - An XML external entity injection (XXE) flaw exists in the Apache ActiveMQ component due to a faulty configuration that allows an XML parser to accept XML external entities from untrusted sources. A remote attacker, by sending crafted XML data, can exploit this to disclose arbitrary files. (CVE-2014-3600) - An authentication bypass vulnerability exists in the Apache ActiveMQ component due to a flaw in the LDAPLoginModule implementation. A remote attacker can exploit this to bypass authentication mechanisms. (CVE-2014-3612) - Multiple cross-site scripting vulnerabilities exist in the administrative console of Apache ActiveMQ that allow a remote attacker to inject arbitrary HTML or web scripts. (CVE-2014-8110) - An invalid free memory error exists due to improper validation of user-supplied input when a DTLS peer receives application data between ChangeCipherSpec and Finished messages. A remote attacker can exploit this to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2014-8176) - A denial of service vulnerability exists when processing an ECParameters structure due to an infinite loop that occurs when a specified curve is over a malformed binary polynomial field. A remote attacker can exploit this to perform a denial of service against any system that processes public keys, certificate requests, or certificates. This includes TLS clients and TLS servers with client authentication enabled. (CVE-2015-1788) - A denial of service vulnerability exists due to improper validation of the content and length of the ASN1_TIME string by the X509_cmp_time() function. A remote attacker can exploit this, via a malformed certificate and CRLs of various sizes, to cause a segmentation fault, resulting in a denial of service condition. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks. (CVE-2015-1789) - A NULL pointer dereference flaw exists in the PKCS#7 parsing code due to incorrect handling of missing inner
    last seen2020-06-01
    modified2020-06-02
    plugin id84960
    published2015-07-23
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84960
    titlePuppet Enterprise 3.x < 3.8.1 Multiple Vulnerabilities (Logjam)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3270.NASL
    descriptionSeveral vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. - CVE-2015-3165 (Remote crash) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. - CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. - CVE-2015-3167 (Possible side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message.
    last seen2020-06-01
    modified2020-06-02
    plugin id83787
    published2015-05-26
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83787
    titleDebian DSA-3270-1 : postgresql-9.4 - security update
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-546.NASL
    descriptionDouble free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
    last seen2020-06-01
    modified2020-06-02
    plugin id84247
    published2015-06-18
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/84247
    titleAmazon Linux AMI : postgresql93 (ALAS-2015-546)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_FC38CD8300B311E58EBD0026551A22DC.NASL
    descriptionPostgreSQL project reports : This update fixes three security vulnerabilities reported in PostgreSQL over the past few months. Nether of these issues is seen as particularly urgent. However, users should examine them in case their installations are vulnerable:. - CVE-2015-3165 Double
    last seen2020-06-01
    modified2020-06-02
    plugin id83799
    published2015-05-26
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83799
    titleFreeBSD : PostgreSQL -- minor security problems. (fc38cd83-00b3-11e5-8ebd-0026551a22dc)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3269.NASL
    descriptionSeveral vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. - CVE-2015-3165 (Remote crash) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. - CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. - CVE-2015-3167 (Possible side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message.
    last seen2020-06-01
    modified2020-06-02
    plugin id83786
    published2015-05-26
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83786
    titleDebian DSA-3269-1 : postgresql-9.1 - security update
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201507-20.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201507-20 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition or escalate privileges. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id84863
    published2015-07-20
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84863
    titleGLSA-201507-20 : PostgreSQL: Multiple vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2621-1.NASL
    descriptionBenkocs Norbert Attila discovered that PostgreSQL incorrectly handled authentication timeouts. A remote attacker could use this flaw to cause the unauthenticated session to crash, possibly leading to a security issue. (CVE-2015-3165) Noah Misch discovered that PostgreSQL incorrectly handled certain standard library function return values, possibly leading to security issues. (CVE-2015-3166) Noah Misch discovered that the pgcrypto function could return different error messages when decrypting using an incorrect key, possibly leading to a security issue. (CVE-2015-3167). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id83862
    published2015-05-27
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83862
    titleUbuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities (USN-2621-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-1194.NASL
    descriptionUpdated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id84446
    published2015-06-30
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84446
    titleCentOS 6 / 7 : postgresql (CESA-2015:1194)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SERVER_5_0_3.NASL
    descriptionThe remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the mod_headers module that allows HTTP trailers to replace HTTP headers late during request processing. A remote attacker can exploit this to inject arbitrary headers. This can also cause some modules to function incorrectly or appear to function incorrectly. (CVE-2013-5704) - A privilege escalation vulnerability exists due to the
    last seen2020-06-01
    modified2020-06-02
    plugin id86066
    published2015-09-22
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86066
    titleMac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-1194.NASL
    descriptionFrom Red Hat Security Advisory 2015:1194 : Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id84464
    published2015-06-30
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84464
    titleOracle Linux 6 / 7 : postgresql (ELSA-2015-1194)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20150629_POSTGRESQL_ON_SL6_X.NASL
    descriptionA double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-03-18
    modified2015-07-06
    plugin id84540
    published2015-07-06
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84540
    titleScientific Linux Security Update : postgresql on SL6.x, SL7.x i386/x86_64 (20150629)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-1264-1.NASL
    descriptionPostgreSQL was updated to the security and bugfix release 9.3.8 including 9.3.7. Security issues fixed : - CVE-2015-3165, bsc#931972: Avoid possible crash when client disconnects just before the authentication timeout expires. - CVE-2015-3166, bsc#931973: Consistently check for failure of the printf() family of functions. - CVE-2015-3167, bsc#931974: In contrib/pgcrypto, uniformly report decryption failures as
    last seen2020-06-01
    modified2020-06-02
    plugin id84896
    published2015-07-21
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84896
    titleSUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:1264-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-1194.NASL
    descriptionUpdated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id84466
    published2015-06-30
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84466
    titleRHEL 6 / 7 : postgresql (RHSA-2015:1194)
  • NASL familyDatabases
    NASL idPOSTGRESQL_20150522.NASL
    descriptionThe version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.20, 9.1.x prior to 9.1.16, 9.2.x prior to 9.2.11, 9.3.x prior to 9.3.7, or 9.4.x prior to 9.4.2. It is, therefore, affected by multiple vulnerabilities : - A double free memory error exists after authentication timeout, which a remote attacker can utilize to cause the program to crash. (CVE-2015-3165) - A flaw exists in the printf() functions due to a failure to check for errors. A remote attacker can use this to gain access to sensitive information. (CVE-2015-3166) - pgcrypto has multiple error messages for decryption with an incorrect key. A remote attacker can use this to recover keys from other systems. (CVE-2015-3167)
    last seen2020-06-01
    modified2020-06-02
    plugin id83818
    published2015-05-27
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83818
    titlePostgreSQL 9.0 < 9.0.20 / 9.1 < 9.1.16 / 9.2 < 9.2.11 / 9.3 < 9.3.7 / 9.4 < 9.4.2 Multiple Vulnerabilities

Redhat

advisories
  • rhsa
    idRHSA-2015:1194
  • rhsa
    idRHSA-2015:1195
  • rhsa
    idRHSA-2015:1196
rpms
  • postgresql-0:8.4.20-3.el6_6
  • postgresql-0:9.2.13-1.ael7b_1
  • postgresql-0:9.2.13-1.el7_1
  • postgresql-contrib-0:8.4.20-3.el6_6
  • postgresql-contrib-0:9.2.13-1.ael7b_1
  • postgresql-contrib-0:9.2.13-1.el7_1
  • postgresql-debuginfo-0:8.4.20-3.el6_6
  • postgresql-debuginfo-0:9.2.13-1.ael7b_1
  • postgresql-debuginfo-0:9.2.13-1.el7_1
  • postgresql-devel-0:8.4.20-3.el6_6
  • postgresql-devel-0:9.2.13-1.ael7b_1
  • postgresql-devel-0:9.2.13-1.el7_1
  • postgresql-docs-0:8.4.20-3.el6_6
  • postgresql-docs-0:9.2.13-1.ael7b_1
  • postgresql-docs-0:9.2.13-1.el7_1
  • postgresql-libs-0:8.4.20-3.el6_6
  • postgresql-libs-0:9.2.13-1.ael7b_1
  • postgresql-libs-0:9.2.13-1.el7_1
  • postgresql-plperl-0:8.4.20-3.el6_6
  • postgresql-plperl-0:9.2.13-1.ael7b_1
  • postgresql-plperl-0:9.2.13-1.el7_1
  • postgresql-plpython-0:8.4.20-3.el6_6
  • postgresql-plpython-0:9.2.13-1.ael7b_1
  • postgresql-plpython-0:9.2.13-1.el7_1
  • postgresql-pltcl-0:8.4.20-3.el6_6
  • postgresql-pltcl-0:9.2.13-1.ael7b_1
  • postgresql-pltcl-0:9.2.13-1.el7_1
  • postgresql-server-0:8.4.20-3.el6_6
  • postgresql-server-0:9.2.13-1.ael7b_1
  • postgresql-server-0:9.2.13-1.el7_1
  • postgresql-test-0:8.4.20-3.el6_6
  • postgresql-test-0:9.2.13-1.ael7b_1
  • postgresql-test-0:9.2.13-1.el7_1
  • postgresql-upgrade-0:9.2.13-1.ael7b_1
  • postgresql-upgrade-0:9.2.13-1.el7_1
  • postgresql92-postgresql-0:9.2.13-1.el6
  • postgresql92-postgresql-0:9.2.13-1.el7
  • postgresql92-postgresql-contrib-0:9.2.13-1.el6
  • postgresql92-postgresql-contrib-0:9.2.13-1.el7
  • postgresql92-postgresql-debuginfo-0:9.2.13-1.el6
  • postgresql92-postgresql-debuginfo-0:9.2.13-1.el7
  • postgresql92-postgresql-devel-0:9.2.13-1.el6
  • postgresql92-postgresql-devel-0:9.2.13-1.el7
  • postgresql92-postgresql-docs-0:9.2.13-1.el6
  • postgresql92-postgresql-docs-0:9.2.13-1.el7
  • postgresql92-postgresql-libs-0:9.2.13-1.el6
  • postgresql92-postgresql-libs-0:9.2.13-1.el7
  • postgresql92-postgresql-plperl-0:9.2.13-1.el6
  • postgresql92-postgresql-plperl-0:9.2.13-1.el7
  • postgresql92-postgresql-plpython-0:9.2.13-1.el6
  • postgresql92-postgresql-plpython-0:9.2.13-1.el7
  • postgresql92-postgresql-pltcl-0:9.2.13-1.el6
  • postgresql92-postgresql-pltcl-0:9.2.13-1.el7
  • postgresql92-postgresql-server-0:9.2.13-1.el6
  • postgresql92-postgresql-server-0:9.2.13-1.el7
  • postgresql92-postgresql-test-0:9.2.13-1.el6
  • postgresql92-postgresql-test-0:9.2.13-1.el7
  • postgresql92-postgresql-upgrade-0:9.2.13-1.el6
  • postgresql92-postgresql-upgrade-0:9.2.13-1.el7
  • rh-postgresql94-postgresql-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-contrib-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-contrib-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-debuginfo-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-debuginfo-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-devel-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-devel-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-docs-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-docs-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-libs-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-libs-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-plperl-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-plperl-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-plpython-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-plpython-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-pltcl-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-pltcl-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-server-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-server-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-test-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-test-0:9.4.4-1.el7
  • rh-postgresql94-postgresql-upgrade-0:9.4.4-1.el6
  • rh-postgresql94-postgresql-upgrade-0:9.4.4-1.el7