Vulnerabilities > CVE-2015-3167 - Information Exposure vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

nessus

NVD

Published: 2019-11-20

Updated: 2019-11-22

Summary

contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect key is used, which makes it easier for attackers to obtain the key via a brute force attack.

Vulnerable Configurations

Part	Description	Count
Application	Postgresql Postgresql Postgresql 9.4 Postgresql Postgresql 9.4-0.5.3.1 Postgresql Postgresql 9.4.0 Postgresql Postgresql 9.4.1 Postgresql Postgresql 9.3 Postgresql Postgresql 9.3.0 Postgresql Postgresql 9.3.1 Postgresql Postgresql 9.3.2 Postgresql Postgresql 9.3.3 Postgresql Postgresql 9.3.4 Postgresql Postgresql 9.3.5 Postgresql Postgresql 9.3.6 Postgresql Postgresql 9.2 Postgresql Postgresql 9.2.0 Postgresql Postgresql 9.2.1 Postgresql Postgresql 9.2.2 Postgresql Postgresql 9.2.3 Postgresql Postgresql 9.2.4 Postgresql Postgresql 9.2.5 Postgresql Postgresql 9.2.6 Postgresql Postgresql 9.2.7 Postgresql Postgresql 9.2.8 Postgresql Postgresql 9.2.9 Postgresql Postgresql 9.2.10 Postgresql Postgresql 9.1 Postgresql Postgresql 9.1.0 Postgresql Postgresql 9.1.1 Postgresql Postgresql 9.1.2 Postgresql Postgresql 9.1.3 Postgresql Postgresql 9.1.4 Postgresql Postgresql 9.1.5 Postgresql Postgresql 9.1.6 Postgresql Postgresql 9.1.7 Postgresql Postgresql 9.1.8 Postgresql Postgresql 9.1.9 Postgresql Postgresql 9.1.10 Postgresql Postgresql 9.1.11 Postgresql Postgresql 9.1.12 Postgresql Postgresql 9.1.13 Postgresql Postgresql 9.1.14 Postgresql Postgresql 9.1.15 Postgresql Postgresql - Postgresql Postgresql 1.0 Postgresql Postgresql 1.01 Postgresql Postgresql 1.02 Postgresql Postgresql 1.08 Postgresql Postgresql 1.09 Postgresql Postgresql 6.0 Postgresql Postgresql 6.1 Postgresql Postgresql 6.1.1 Postgresql Postgresql 6.2 Postgresql Postgresql 6.2.1 Postgresql Postgresql 6.3 Postgresql Postgresql 6.3.1 Postgresql Postgresql 6.3.2 Postgresql Postgresql 6.4 Postgresql Postgresql 6.4.1 Postgresql Postgresql 6.4.2 Postgresql Postgresql 6.5 Postgresql Postgresql 6.5.0 Postgresql Postgresql 6.5.1 Postgresql Postgresql 6.5.2 Postgresql Postgresql 6.5.3 Postgresql Postgresql 7.0 Postgresql Postgresql 7.0.1 Postgresql Postgresql 7.0.2 Postgresql Postgresql 7.0.3 Postgresql Postgresql 7.1 Postgresql Postgresql 7.1.1 Postgresql Postgresql 7.1.2 Postgresql Postgresql 7.1.3 Postgresql Postgresql 7.2 Postgresql Postgresql 7.2.1 Postgresql Postgresql 7.2.2 Postgresql Postgresql 7.2.3 Postgresql Postgresql 7.2.4 Postgresql Postgresql 7.2.5 Postgresql Postgresql 7.2.6 Postgresql Postgresql 7.2.7 Postgresql Postgresql 7.2.8 Postgresql Postgresql 7.3 Postgresql Postgresql 7.3.0 Postgresql Postgresql 7.3.1 Postgresql Postgresql 7.3.2 Postgresql Postgresql 7.3.3 Postgresql Postgresql 7.3.4 Postgresql Postgresql 7.3.5 Postgresql Postgresql 7.3.6 Postgresql Postgresql 7.3.7 Postgresql Postgresql 7.3.8 Postgresql Postgresql 7.3.9 Postgresql Postgresql 7.3.10 Postgresql Postgresql 7.3.11 Postgresql Postgresql 7.3.12 Postgresql Postgresql 7.3.13 Postgresql Postgresql 7.3.14 Postgresql Postgresql 7.3.15 Postgresql Postgresql 7.3.16 Postgresql Postgresql 7.3.17 Postgresql Postgresql 7.3.18 Postgresql Postgresql 7.3.19 Postgresql Postgresql 7.3.20 Postgresql Postgresql 7.3.21 Postgresql Postgresql 7.4 Postgresql Postgresql 7.4.1 Postgresql Postgresql 7.4.2 Postgresql Postgresql 7.4.3 Postgresql Postgresql 7.4.4 Postgresql Postgresql 7.4.5 Postgresql Postgresql 7.4.6 Postgresql Postgresql 7.4.7 Postgresql Postgresql 7.4.8 Postgresql Postgresql 7.4.9 Postgresql Postgresql 7.4.10 Postgresql Postgresql 7.4.11 Postgresql Postgresql 7.4.12 Postgresql Postgresql 7.4.13 Postgresql Postgresql 7.4.14 Postgresql Postgresql 7.4.15 Postgresql Postgresql 7.4.16 Postgresql Postgresql 7.4.17 Postgresql Postgresql 7.4.18 Postgresql Postgresql 7.4.19 Postgresql Postgresql 7.4.20 Postgresql Postgresql 7.4.21 Postgresql Postgresql 7.4.22 Postgresql Postgresql 7.4.23 Postgresql Postgresql 7.4.24 Postgresql Postgresql 7.4.25 Postgresql Postgresql 7.4.26 Postgresql Postgresql 7.4.27 Postgresql Postgresql 7.4.28 Postgresql Postgresql 7.4.29 Postgresql Postgresql 7.4.30 Postgresql Postgresql 8.0 Postgresql Postgresql 8.0.0 Postgresql Postgresql 8.0.1 Postgresql Postgresql 8.0.2 Postgresql Postgresql 8.0.3 Postgresql Postgresql 8.0.4 Postgresql Postgresql 8.0.5 Postgresql Postgresql 8.0.6 Postgresql Postgresql 8.0.7 Postgresql Postgresql 8.0.8 Postgresql Postgresql 8.0.9 Postgresql Postgresql 8.0.10 Postgresql Postgresql 8.0.11 Postgresql Postgresql 8.0.12 Postgresql Postgresql 8.0.13 Postgresql Postgresql 8.0.14 Postgresql Postgresql 8.0.15 Postgresql Postgresql 8.0.16 Postgresql Postgresql 8.0.17 Postgresql Postgresql 8.0.18 Postgresql Postgresql 8.0.19 Postgresql Postgresql 8.0.20 Postgresql Postgresql 8.0.21 Postgresql Postgresql 8.0.22 Postgresql Postgresql 8.0.23 Postgresql Postgresql 8.0.24 Postgresql Postgresql 8.0.25 Postgresql Postgresql 8.0.26 Postgresql Postgresql 8.1 Postgresql Postgresql 8.1.0 Postgresql Postgresql 8.1.1 Postgresql Postgresql 8.1.2 Postgresql Postgresql 8.1.3 Postgresql Postgresql 8.1.4 Postgresql Postgresql 8.1.5 Postgresql Postgresql 8.1.6 Postgresql Postgresql 8.1.7 Postgresql Postgresql 8.1.8 Postgresql Postgresql 8.1.9 Postgresql Postgresql 8.1.10 Postgresql Postgresql 8.1.11 Postgresql Postgresql 8.1.12 Postgresql Postgresql 8.1.13 Postgresql Postgresql 8.1.14 Postgresql Postgresql 8.1.15 Postgresql Postgresql 8.1.16 Postgresql Postgresql 8.1.17 Postgresql Postgresql 8.1.18 Postgresql Postgresql 8.1.19 Postgresql Postgresql 8.1.20 Postgresql Postgresql 8.1.21 Postgresql Postgresql 8.1.22 Postgresql Postgresql 8.1.23 Postgresql Postgresql 8.2 Postgresql Postgresql 8.2.0 Postgresql Postgresql 8.2.1 Postgresql Postgresql 8.2.2 Postgresql Postgresql 8.2.3 Postgresql Postgresql 8.2.4 Postgresql Postgresql 8.2.5 Postgresql Postgresql 8.2.6 Postgresql Postgresql 8.2.7 Postgresql Postgresql 8.2.8 Postgresql Postgresql 8.2.9 Postgresql Postgresql 8.2.10 Postgresql Postgresql 8.2.11 Postgresql Postgresql 8.2.12 Postgresql Postgresql 8.2.13 Postgresql Postgresql 8.2.14 Postgresql Postgresql 8.2.15 Postgresql Postgresql 8.2.16 Postgresql Postgresql 8.2.17 Postgresql Postgresql 8.2.18 Postgresql Postgresql 8.2.19 Postgresql Postgresql 8.2.20 Postgresql Postgresql 8.2.21 Postgresql Postgresql 8.2.22 Postgresql Postgresql 8.2.23 Postgresql Postgresql 8.3 Postgresql Postgresql 8.3.0 Postgresql Postgresql 8.3.1 Postgresql Postgresql 8.3.2 Postgresql Postgresql 8.3.3 Postgresql Postgresql 8.3.4 Postgresql Postgresql 8.3.5 Postgresql Postgresql 8.3.6 Postgresql Postgresql 8.3.7 Postgresql Postgresql 8.3.8 Postgresql Postgresql 8.3.9 Postgresql Postgresql 8.3.10 Postgresql Postgresql 8.3.11 Postgresql Postgresql 8.3.12 Postgresql Postgresql 8.3.13 Postgresql Postgresql 8.3.14 Postgresql Postgresql 8.3.15 Postgresql Postgresql 8.3.16 Postgresql Postgresql 8.3.17 Postgresql Postgresql 8.3.18 Postgresql Postgresql 8.3.19 Postgresql Postgresql 8.3.20 Postgresql Postgresql 8.3.21 Postgresql Postgresql 8.3.22 Postgresql Postgresql 8.3.23 Postgresql Postgresql 8.4 Postgresql Postgresql 8.4.0 Postgresql Postgresql 8.4.1 Postgresql Postgresql 8.4.2 Postgresql Postgresql 8.4.3 Postgresql Postgresql 8.4.4 Postgresql Postgresql 8.4.5 Postgresql Postgresql 8.4.6 Postgresql Postgresql 8.4.7 Postgresql Postgresql 8.4.8 Postgresql Postgresql 8.4.9 Postgresql Postgresql 8.4.10 Postgresql Postgresql 8.4.11 Postgresql Postgresql 8.4.12 Postgresql Postgresql 8.4.13 Postgresql Postgresql 8.4.14 Postgresql Postgresql 8.4.15 Postgresql Postgresql 8.4.16 Postgresql Postgresql 8.4.17 Postgresql Postgresql 8.4.18 Postgresql Postgresql 8.4.19 Postgresql Postgresql 8.4.20 Postgresql Postgresql 8.4.21 Postgresql Postgresql 8.4.22 Postgresql Postgresql 9.0 Postgresql Postgresql 9.0.0 Postgresql Postgresql 9.0.1 Postgresql Postgresql 9.0.2 Postgresql Postgresql 9.0.3 Postgresql Postgresql 9.0.4 Postgresql Postgresql 9.0.5 Postgresql Postgresql 9.0.6 Postgresql Postgresql 9.0.7 Postgresql Postgresql 9.0.8 Postgresql Postgresql 9.0.9 Postgresql Postgresql 9.0.10 Postgresql Postgresql 9.0.11 Postgresql Postgresql 9.0.12 Postgresql Postgresql 9.0.13 Postgresql Postgresql 9.0.14 Postgresql Postgresql 9.0.15 Postgresql Postgresql 9.0.16 Postgresql Postgresql 9.0.17 Postgresql Postgresql 9.0.18 Postgresql Postgresql 9.0.19	284
OS	Debian Debian Debian Linux 8.0 Debian Debian Linux 7.0 Debian Debian Linux 9.0	3
OS	Canonical Canonical Ubuntu Linux 12.04 Canonical Ubuntu Linux 14.10 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 15.04	4

Common Weakness Enumeration (CWE)

CWE-200 - Information Exposure

Common Attack Pattern Enumeration and Classification (CAPEC)

Subverting Environment Variable Values
The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
Footprinting
An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
Exploiting Trust in Client (aka Make the Client Invisible)
An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
Browser Fingerprinting
An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2015-1091-1.NASL
description	This update provides PostgreSQL 9.1.18, which brings fixes for security issues and other enhancements. The following vulnerabilities have been fixed : CVE-2015-3165: Avoid possible crash when client disconnects. (bsc#931972) CVE-2015-3166: Consistently check for failure of the *printf(). (bsc#931973) CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption failures. (bsc#931974) For a comprehensive list of changes, please refer to <a href=
last seen	2020-06-01
modified	2020-06-02
plugin id	84338
published	2015-06-23
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84338
title	SUSE SLED11 / SLES11 Security Update : postgresql91 (SUSE-SU-2015:1091-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2015:1091-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(84338); script_version("2.18"); script_cvs_date("Date: 2019/11/25"); script_cve_id("CVE-2015-3165", "CVE-2015-3166", "CVE-2015-3167"); script_bugtraq_id(74787, 74789, 74790); script_name(english:"SUSE SLED11 / SLES11 Security Update : postgresql91 (SUSE-SU-2015:1091-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update provides PostgreSQL 9.1.18, which brings fixes for security issues and other enhancements. The following vulnerabilities have been fixed : CVE-2015-3165: Avoid possible crash when client disconnects. (bsc#931972) CVE-2015-3166: Consistently check for failure of the *printf(). (bsc#931973) CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption failures. (bsc#931974) For a comprehensive list of changes, please refer to <a href='http://www.postgresql.org/docs/9.1/static/release-9-1-18.html'>h ttp://www.postgresql.org/docs/9.1/static/release-9-1-18.html</a>. This update also includes changes in PostgreSQL's packaging to prepare for the migration to the new major version 9.4. (FATE#316970, bsc#907651) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); # http://www.postgresql.org/docs/9.1/static/release-9-1-18.html script_set_attribute( attribute:"see_also", value:"https://www.postgresql.org/docs/9.1/release-9-1-18.html" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=907651" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=931972" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=931973" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=931974" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=932040" ); # https://download.suse.com/patch/finder/?keywords=00fcb88ab431584bc7bf32ba75396dee script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?36f6d275" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2015-3165/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2015-3166/" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2015-3167/" ); # https://www.suse.com/support/update/announcement/2015/suse-su-20151091-1.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?23fcfb6c" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product : SUSE Manager Server : zypper in -t patch sleman21-postgresql91-201505=10760 SUSE Linux Enterprise Software Development Kit 11 SP3 : zypper in -t patch sdksp3-postgresql91-201505=10760 SUSE Linux Enterprise Server 11 SP3 for VMware : zypper in -t patch slessp3-postgresql91-201505=10760 SUSE Linux Enterprise Server 11 SP3 : zypper in -t patch slessp3-postgresql91-201505=10760 SUSE Linux Enterprise Desktop 11 SP3 : zypper in -t patch sledsp3-postgresql91-201505=10760 To bring your system up-to-date, use 'zypper patch'." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91-docs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:postgresql91-server"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/05/28"); script_set_attribute(attribute:"patch_publication_date", value:"2015/06/19"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/06/23"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLED11\|SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED11 / SLES11", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES11" && (! preg(pattern:"^(3)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP3", os_ver + " SP" + sp); if (os_ver == "SLED11" && (! preg(pattern:"^(3)$", string:sp))) audit(AUDIT_OS_NOT, "SLED11 SP3", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-9.1.18-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-contrib-9.1.18-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-docs-9.1.18-0.3.1")) flag++; if (rpm_check(release:"SLES11", sp:"3", reference:"postgresql91-server-9.1.18-0.3.1")) flag++; if (rpm_check(release:"SLED11", sp:"3", cpu:"x86_64", reference:"postgresql91-9.1.18-0.3.1")) flag++; if (rpm_check(release:"SLED11", sp:"3", cpu:"x86_64", reference:"postgresql91-docs-9.1.18-0.3.1")) flag++; if (rpm_check(release:"SLED11", sp:"3", cpu:"i586", reference:"postgresql91-9.1.18-0.3.1")) flag++; if (rpm_check(release:"SLED11", sp:"3", cpu:"i586", reference:"postgresql91-docs-9.1.18-0.3.1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql91"); }

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2015-556.NASL
description	A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167)
last seen	2020-06-01
modified	2020-06-02
plugin id	84592
published	2015-07-08
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84592
title	Amazon Linux AMI : postgresql8 (ALAS-2015-556)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Amazon Linux AMI Security Advisory ALAS-2015-556. # include("compat.inc"); if (description) { script_id(84592); script_version("2.6"); script_cvs_date("Date: 2019/11/25"); script_cve_id("CVE-2015-3165", "CVE-2015-3166", "CVE-2015-3167"); script_xref(name:"ALAS", value:"2015-556"); script_xref(name:"RHSA", value:"2015:1194"); script_name(english:"Amazon Linux AMI : postgresql8 (ALAS-2015-556)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Amazon Linux AMI host is missing a security update." ); script_set_attribute( attribute:"description", value: "A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167)" ); script_set_attribute( attribute:"see_also", value:"https://alas.aws.amazon.com/ALAS-2015-556.html" ); script_set_attribute( attribute:"solution", value:"Run 'yum update postgresql8' to update your system." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-contrib"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-docs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-libs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plperl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plpython"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-pltcl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-test"); script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/05/28"); script_set_attribute(attribute:"patch_publication_date", value:"2015/07/07"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/08"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Amazon Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/AmazonLinux/release"); if (isnull(release) \|\| !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux"); os_ver = pregmatch(pattern: "^AL(A\|\d)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux"); os_ver = os_ver[1]; if (os_ver != "A") { if (os_ver == 'A') os_ver = 'AMI'; audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver); } if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (rpm_check(release:"ALA", reference:"postgresql8-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-contrib-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-debuginfo-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-devel-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-docs-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-libs-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-plperl-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-plpython-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-pltcl-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-server-8.4.20-3.50.amzn1")) flag++; if (rpm_check(release:"ALA", reference:"postgresql8-test-8.4.20-3.50.amzn1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql8 / postgresql8-contrib / postgresql8-debuginfo / etc"); }

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-227.NASL
description	Several vulnerabilities were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS minor version contains the fixes that were applied upstream to the 9.0.20 version, backported to 8.4.22 which was the last version officially released by the PostgreSQL developers. This LTS effort for squeeze-lts is a community project sponsored by credativ GmbH. CVE-2015-3165: Remote crash SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. CVE-2015-3166: Information exposure The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. CVE-2015-3167: Possible side-channel key exposure In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message. Note that the next round of minor releases for PostgreSQL have already been scheduled for early June 2015. There will be a corresponding 8.4.22lts3 update at the same time. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2015-06-01
plugin id	83905
published	2015-06-01
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/83905
title	Debian DLA-227-1 : postgresql-8.4 update

NASL family	CGI abuses
NASL id	PUPPET_ENTERPRISE_ACTIVEMQ_PSQL_SSL.NASL
description	According to its self-reported version number, the Puppet Enterprise application running on the remote host is 3.x prior to 3.8.1. It is, therefore, affected by the following vulnerabilities : - An XML external entity injection (XXE) flaw exists in the Apache ActiveMQ component due to a faulty configuration that allows an XML parser to accept XML external entities from untrusted sources. A remote attacker, by sending crafted XML data, can exploit this to disclose arbitrary files. (CVE-2014-3600) - An authentication bypass vulnerability exists in the Apache ActiveMQ component due to a flaw in the LDAPLoginModule implementation. A remote attacker can exploit this to bypass authentication mechanisms. (CVE-2014-3612) - Multiple cross-site scripting vulnerabilities exist in the administrative console of Apache ActiveMQ that allow a remote attacker to inject arbitrary HTML or web scripts. (CVE-2014-8110) - An invalid free memory error exists due to improper validation of user-supplied input when a DTLS peer receives application data between ChangeCipherSpec and Finished messages. A remote attacker can exploit this to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2014-8176) - A denial of service vulnerability exists when processing an ECParameters structure due to an infinite loop that occurs when a specified curve is over a malformed binary polynomial field. A remote attacker can exploit this to perform a denial of service against any system that processes public keys, certificate requests, or certificates. This includes TLS clients and TLS servers with client authentication enabled. (CVE-2015-1788) - A denial of service vulnerability exists due to improper validation of the content and length of the ASN1_TIME string by the X509_cmp_time() function. A remote attacker can exploit this, via a malformed certificate and CRLs of various sizes, to cause a segmentation fault, resulting in a denial of service condition. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks. (CVE-2015-1789) - A NULL pointer dereference flaw exists in the PKCS#7 parsing code due to incorrect handling of missing inner
last seen	2020-06-01
modified	2020-06-02
plugin id	84960
published	2015-07-23
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84960
title	Puppet Enterprise 3.x < 3.8.1 Multiple Vulnerabilities (Logjam)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3270.NASL
description	Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. - CVE-2015-3165 (Remote crash) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. - CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. - CVE-2015-3167 (Possible side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message.
last seen	2020-06-01
modified	2020-06-02
plugin id	83787
published	2015-05-26
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/83787
title	Debian DSA-3270-1 : postgresql-9.4 - security update

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_FC38CD8300B311E58EBD0026551A22DC.NASL
description	PostgreSQL project reports : This update fixes three security vulnerabilities reported in PostgreSQL over the past few months. Nether of these issues is seen as particularly urgent. However, users should examine them in case their installations are vulnerable:. - CVE-2015-3165 Double
last seen	2020-06-01
modified	2020-06-02
plugin id	83799
published	2015-05-26
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/83799
title	FreeBSD : PostgreSQL -- minor security problems. (fc38cd83-00b3-11e5-8ebd-0026551a22dc)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3269.NASL
description	Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. - CVE-2015-3165 (Remote crash) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. - CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. - CVE-2015-3167 (Possible side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message.
last seen	2020-06-01
modified	2020-06-02
plugin id	83786
published	2015-05-26
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/83786
title	Debian DSA-3269-1 : postgresql-9.1 - security update

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201507-20.NASL
description	The remote host is affected by the vulnerability described in GLSA-201507-20 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition or escalate privileges. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	84863
published	2015-07-20
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84863
title	GLSA-201507-20 : PostgreSQL: Multiple vulnerabilities

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-2621-1.NASL
description	Benkocs Norbert Attila discovered that PostgreSQL incorrectly handled authentication timeouts. A remote attacker could use this flaw to cause the unauthenticated session to crash, possibly leading to a security issue. (CVE-2015-3165) Noah Misch discovered that PostgreSQL incorrectly handled certain standard library function return values, possibly leading to security issues. (CVE-2015-3166) Noah Misch discovered that the pgcrypto function could return different error messages when decrypting using an incorrect key, possibly leading to a security issue. (CVE-2015-3167). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	83862
published	2015-05-27
reporter	Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/83862
title	Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities (USN-2621-1)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2015-1194.NASL
description	Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
last seen	2020-06-01
modified	2020-06-02
plugin id	84446
published	2015-06-30
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84446
title	CentOS 6 / 7 : postgresql (CESA-2015:1194)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SERVER_5_0_3.NASL
description	The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the mod_headers module that allows HTTP trailers to replace HTTP headers late during request processing. A remote attacker can exploit this to inject arbitrary headers. This can also cause some modules to function incorrectly or appear to function incorrectly. (CVE-2013-5704) - A privilege escalation vulnerability exists due to the
last seen	2020-06-01
modified	2020-06-02
plugin id	86066
published	2015-09-22
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/86066
title	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2015-1194.NASL
description	From Red Hat Security Advisory 2015:1194 : Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
last seen	2020-06-01
modified	2020-06-02
plugin id	84464
published	2015-06-30
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84464
title	Oracle Linux 6 / 7 : postgresql (ELSA-2015-1194)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20150629_POSTGRESQL_ON_SL6_X.NASL
description	A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) If the postgresql service is running, it will be automatically restarted after installing this update.
last seen	2020-03-18
modified	2015-07-06
plugin id	84540
published	2015-07-06
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84540
title	Scientific Linux Security Update : postgresql on SL6.x, SL7.x i386/x86_64 (20150629)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2015-1264-1.NASL
description	PostgreSQL was updated to the security and bugfix release 9.3.8 including 9.3.7. Security issues fixed : - CVE-2015-3165, bsc#931972: Avoid possible crash when client disconnects just before the authentication timeout expires. - CVE-2015-3166, bsc#931973: Consistently check for failure of the printf() family of functions. - CVE-2015-3167, bsc#931974: In contrib/pgcrypto, uniformly report decryption failures as
last seen	2020-06-01
modified	2020-06-02
plugin id	84896
published	2015-07-21
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84896
title	SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:1264-1)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2015-1194.NASL
description	Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
last seen	2020-06-01
modified	2020-06-02
plugin id	84466
published	2015-06-30
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84466
title	RHEL 6 / 7 : postgresql (RHSA-2015:1194)

NASL family	Databases
NASL id	POSTGRESQL_20150522.NASL
description	The version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.20, 9.1.x prior to 9.1.16, 9.2.x prior to 9.2.11, 9.3.x prior to 9.3.7, or 9.4.x prior to 9.4.2. It is, therefore, affected by multiple vulnerabilities : - A double free memory error exists after authentication timeout, which a remote attacker can utilize to cause the program to crash. (CVE-2015-3165) - A flaw exists in the printf() functions due to a failure to check for errors. A remote attacker can use this to gain access to sensitive information. (CVE-2015-3166) - pgcrypto has multiple error messages for decryption with an incorrect key. A remote attacker can use this to recover keys from other systems. (CVE-2015-3167)
last seen	2020-06-01
modified	2020-06-02
plugin id	83818
published	2015-05-27
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/83818
title	PostgreSQL 9.0 < 9.0.20 / 9.1 < 9.1.16 / 9.2 < 9.2.11 / 9.3 < 9.3.7 / 9.4 < 9.4.2 Multiple Vulnerabilities

Redhat

advisories

bugzilla

id	1221541
title	CVE-2015-3167 postgresql: pgcrypto has multiple error messages for decryption with an incorrect key.

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND

comment postgresql-plpython is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194001
comment postgresql-plpython is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908018

AND

comment postgresql-test is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194003
comment postgresql-test is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908006

AND

comment postgresql-devel is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194005
comment postgresql-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908016

AND

comment postgresql-plperl is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194007
comment postgresql-plperl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908012

AND
comment postgresql is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194009
comment postgresql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908002

AND

comment postgresql-pltcl is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194011
comment postgresql-pltcl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908004

AND

comment postgresql-contrib is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194013
comment postgresql-contrib is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908008

AND

comment postgresql-docs is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194015
comment postgresql-docs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908010

AND

comment postgresql-server is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194017
comment postgresql-server is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908020

AND

comment postgresql-libs is earlier than 0:8.4.20-3.el6_6
oval oval:com.redhat.rhsa:tst:20151194019
comment postgresql-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908014

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND

comment postgresql-upgrade is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194022
comment postgresql-upgrade is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150750030

AND

comment postgresql-libs is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194024
comment postgresql-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908014

AND
comment postgresql is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194025
comment postgresql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908002

AND

comment postgresql-contrib is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194026
comment postgresql-contrib is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908008

AND

comment postgresql-plpython is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194027
comment postgresql-plpython is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908018

AND

comment postgresql-docs is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194028
comment postgresql-docs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908010

AND

comment postgresql-devel is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194029
comment postgresql-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908016

AND

comment postgresql-test is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194030
comment postgresql-test is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908006

AND

comment postgresql-plperl is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194031
comment postgresql-plperl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908012

AND

comment postgresql-server is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194032
comment postgresql-server is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908020

AND

comment postgresql-pltcl is earlier than 0:9.2.13-1.el7_1
oval oval:com.redhat.rhsa:tst:20151194033
comment postgresql-pltcl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100908004

rhsa

id	RHSA-2015:1194
released	2015-06-29
severity	Moderate
title	RHSA-2015:1194: postgresql security update (Moderate)

rpms

postgresql-0:8.4.20-3.el6_6
postgresql-0:9.2.13-1.ael7b_1
postgresql-0:9.2.13-1.el7_1
postgresql-contrib-0:8.4.20-3.el6_6
postgresql-contrib-0:9.2.13-1.ael7b_1
postgresql-contrib-0:9.2.13-1.el7_1
postgresql-debuginfo-0:8.4.20-3.el6_6
postgresql-debuginfo-0:9.2.13-1.ael7b_1
postgresql-debuginfo-0:9.2.13-1.el7_1
postgresql-devel-0:8.4.20-3.el6_6
postgresql-devel-0:9.2.13-1.ael7b_1
postgresql-devel-0:9.2.13-1.el7_1
postgresql-docs-0:8.4.20-3.el6_6
postgresql-docs-0:9.2.13-1.ael7b_1
postgresql-docs-0:9.2.13-1.el7_1
postgresql-libs-0:8.4.20-3.el6_6
postgresql-libs-0:9.2.13-1.ael7b_1
postgresql-libs-0:9.2.13-1.el7_1
postgresql-plperl-0:8.4.20-3.el6_6
postgresql-plperl-0:9.2.13-1.ael7b_1
postgresql-plperl-0:9.2.13-1.el7_1
postgresql-plpython-0:8.4.20-3.el6_6
postgresql-plpython-0:9.2.13-1.ael7b_1
postgresql-plpython-0:9.2.13-1.el7_1
postgresql-pltcl-0:8.4.20-3.el6_6
postgresql-pltcl-0:9.2.13-1.ael7b_1
postgresql-pltcl-0:9.2.13-1.el7_1
postgresql-server-0:8.4.20-3.el6_6
postgresql-server-0:9.2.13-1.ael7b_1
postgresql-server-0:9.2.13-1.el7_1
postgresql-test-0:8.4.20-3.el6_6
postgresql-test-0:9.2.13-1.ael7b_1
postgresql-test-0:9.2.13-1.el7_1
postgresql-upgrade-0:9.2.13-1.ael7b_1
postgresql-upgrade-0:9.2.13-1.el7_1
postgresql92-postgresql-0:9.2.13-1.el6
postgresql92-postgresql-0:9.2.13-1.el7
postgresql92-postgresql-contrib-0:9.2.13-1.el6
postgresql92-postgresql-contrib-0:9.2.13-1.el7
postgresql92-postgresql-debuginfo-0:9.2.13-1.el6
postgresql92-postgresql-debuginfo-0:9.2.13-1.el7
postgresql92-postgresql-devel-0:9.2.13-1.el6
postgresql92-postgresql-devel-0:9.2.13-1.el7
postgresql92-postgresql-docs-0:9.2.13-1.el6
postgresql92-postgresql-docs-0:9.2.13-1.el7
postgresql92-postgresql-libs-0:9.2.13-1.el6
postgresql92-postgresql-libs-0:9.2.13-1.el7
postgresql92-postgresql-plperl-0:9.2.13-1.el6
postgresql92-postgresql-plperl-0:9.2.13-1.el7
postgresql92-postgresql-plpython-0:9.2.13-1.el6
postgresql92-postgresql-plpython-0:9.2.13-1.el7
postgresql92-postgresql-pltcl-0:9.2.13-1.el6
postgresql92-postgresql-pltcl-0:9.2.13-1.el7
postgresql92-postgresql-server-0:9.2.13-1.el6
postgresql92-postgresql-server-0:9.2.13-1.el7
postgresql92-postgresql-test-0:9.2.13-1.el6
postgresql92-postgresql-test-0:9.2.13-1.el7
postgresql92-postgresql-upgrade-0:9.2.13-1.el6
postgresql92-postgresql-upgrade-0:9.2.13-1.el7
rh-postgresql94-postgresql-0:9.4.4-1.el6
rh-postgresql94-postgresql-0:9.4.4-1.el7
rh-postgresql94-postgresql-contrib-0:9.4.4-1.el6
rh-postgresql94-postgresql-contrib-0:9.4.4-1.el7
rh-postgresql94-postgresql-debuginfo-0:9.4.4-1.el6
rh-postgresql94-postgresql-debuginfo-0:9.4.4-1.el7
rh-postgresql94-postgresql-devel-0:9.4.4-1.el6
rh-postgresql94-postgresql-devel-0:9.4.4-1.el7
rh-postgresql94-postgresql-docs-0:9.4.4-1.el6
rh-postgresql94-postgresql-docs-0:9.4.4-1.el7
rh-postgresql94-postgresql-libs-0:9.4.4-1.el6
rh-postgresql94-postgresql-libs-0:9.4.4-1.el7
rh-postgresql94-postgresql-plperl-0:9.4.4-1.el6
rh-postgresql94-postgresql-plperl-0:9.4.4-1.el7
rh-postgresql94-postgresql-plpython-0:9.4.4-1.el6
rh-postgresql94-postgresql-plpython-0:9.4.4-1.el7
rh-postgresql94-postgresql-pltcl-0:9.4.4-1.el6
rh-postgresql94-postgresql-pltcl-0:9.4.4-1.el7
rh-postgresql94-postgresql-server-0:9.4.4-1.el6
rh-postgresql94-postgresql-server-0:9.4.4-1.el7
rh-postgresql94-postgresql-test-0:9.4.4-1.el6
rh-postgresql94-postgresql-test-0:9.4.4-1.el7
rh-postgresql94-postgresql-upgrade-0:9.4.4-1.el6
rh-postgresql94-postgresql-upgrade-0:9.4.4-1.el7

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Redhat

References