Vulnerabilities > CVE-2015-5288 - Information Exposure vulnerability in Postgresql

047910
CVSS 6.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
postgresql
CWE-200
nessus

Summary

The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.

Vulnerable Configurations

Part Description Count
Application
Postgresql
292

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20151118_POSTGRESQL_ON_SL6_X.NASL
    descriptionA memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-03-18
    modified2015-11-19
    plugin id86939
    published2015-11-19
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86939
    titleScientific Linux Security Update : postgresql on SL6.x i386/x86_64 (20151118)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(86939);
      script_version("2.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/25");
    
      script_cve_id("CVE-2015-5288");
    
      script_name(english:"Scientific Linux Security Update : postgresql on SL6.x i386/x86_64 (20151118)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A memory leak error was discovered in the crypt() function of the
    pgCrypto extension. An authenticated attacker could possibly use this
    flaw to disclose a limited amount of the server memory.
    (CVE-2015-5288)
    
    If the postgresql service is running, it will be automatically
    restarted after installing this update."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1511&L=scientific-linux-errata&F=&S=&P=14456
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?0094e013"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:postgresql-test");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2015/10/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/11/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/19");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 6.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL6", reference:"postgresql-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-contrib-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-debuginfo-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-devel-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-docs-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-libs-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-plperl-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-plpython-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-pltcl-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-server-8.4.20-4.el6_7")) flag++;
    if (rpm_check(release:"SL6", reference:"postgresql-test-8.4.20-4.el6_7")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_WARNING,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql / postgresql-contrib / postgresql-debuginfo / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-701.NASL
    descriptionpostgresql93 was updated to version 9.3.10 to fix two security issues. These security issues were fixed : - CVE-2015-5288: Unchecked JSON input can crash the server (bsc#949669). - CVE-2015-5289: Memory leak in crypt() function (bsc#949670). For the full release notes, please see: http://www.postgresql.org/docs/current/static/release-9-3-10.html
    last seen2020-06-05
    modified2015-11-05
    plugin id86736
    published2015-11-05
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86736
    titleopenSUSE Security Update : postgresql93 (openSUSE-2015-701)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2015-701.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(86736);
      script_version("2.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-5288", "CVE-2015-5289");
    
      script_name(english:"openSUSE Security Update : postgresql93 (openSUSE-2015-701)");
      script_summary(english:"Check for the openSUSE-2015-701 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "postgresql93 was updated to version 9.3.10 to fix two security issues.
    
    These security issues were fixed :
    
      - CVE-2015-5288: Unchecked JSON input can crash the server
        (bsc#949669).
    
      - CVE-2015-5289: Memory leak in crypt() function
        (bsc#949670).
    
    For the full release notes, please see:
    http://www.postgresql.org/docs/current/static/release-9-3-10.html"
      );
      # http://www.postgresql.org/docs/current/static/release-9-3-10.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/current/release-9-3-10.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=949669"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=949670"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql93 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libecpg6-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpq5-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-contrib-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-libs-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plperl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-plpython-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-pltcl-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-server-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:postgresql93-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/10/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE13\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "13.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE13.2", reference:"libecpg6-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libecpg6-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libpq5-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"libpq5-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-contrib-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-contrib-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-debugsource-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-devel-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-devel-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-libs-debugsource-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plperl-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plperl-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plpython-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-plpython-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-pltcl-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-pltcl-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-server-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-server-debuginfo-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", reference:"postgresql93-test-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libecpg6-32bit-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libecpg6-debuginfo-32bit-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libpq5-32bit-9.3.10-2.7.1") ) flag++;
    if ( rpm_check(release:"SUSE13.2", cpu:"x86_64", reference:"libpq5-debuginfo-32bit-9.3.10-2.7.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libecpg6-32bit / libecpg6 / libecpg6-debuginfo-32bit / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-7FAC92F49C.NASL
    descriptionupdate to 9.4.5 per release notes http://www.postgresql.org/docs/9.4/static/release-9-4-5.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89301
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89301
    titleFedora 23 : postgresql-9.4.5-1.fc23 (2015-7fac92f49c)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2015-7fac92f49c.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(89301);
      script_version("2.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2015-5288", "CVE-2015-5289");
      script_xref(name:"FEDORA", value:"2015-7fac92f49c");
    
      script_name(english:"Fedora 23 : postgresql-9.4.5-1.fc23 (2015-7fac92f49c)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "update to 9.4.5 per release notes
    http://www.postgresql.org/docs/9.4/static/release-9-4-5.html
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://www.postgresql.org/docs/9.4/static/release-9-4-5.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.postgresql.org/docs/9.4/release-9-4-5.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=1270314"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2015-October/169094.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d19f8526"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected postgresql package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:postgresql");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:23");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/10/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^23([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 23.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC23", reference:"postgresql-9.4.5-1.fc23")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3374.NASL
    descriptionSeveral vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. - CVE-2015-5288 Josh Kupershmidt discovered a vulnerability in the crypt() function in the pgCrypto extension. Certain invalid salt arguments can cause the server to crash or to disclose a few bytes of server memory. - CVE-2015-5289 Oskari Saarenmaa discovered that json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service.
    last seen2020-06-01
    modified2020-06-02
    plugin id86447
    published2015-10-20
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86447
    titleDebian DSA-3374-1 : postgresql-9.4 - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3374. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(86447);
      script_version("2.7");
      script_cvs_date("Date: 2018/11/10 11:49:37");
    
      script_cve_id("CVE-2015-5288", "CVE-2015-5289");
      script_xref(name:"DSA", value:"3374");
    
      script_name(english:"Debian DSA-3374-1 : postgresql-9.4 - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been found in PostgreSQL-9.4, a SQL
    database system.
    
      - CVE-2015-5288
        Josh Kupershmidt discovered a vulnerability in the
        crypt() function in the pgCrypto extension. Certain
        invalid salt arguments can cause the server to crash or
        to disclose a few bytes of server memory.
    
      - CVE-2015-5289
        Oskari Saarenmaa discovered that json or jsonb input
        values constructed from arbitrary user input can crash
        the PostgreSQL server and cause a denial of service."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2015-5288"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2015-5289"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/postgresql-9.4"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2015/dsa-3374"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the postgresql-9.4 packages.
    
    For the stable distribution (jessie), these problems have been fixed
    in version 9.4.5-0+deb8u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:postgresql-9.4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/10/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/10/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"libecpg-compat3", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libecpg-dev", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libecpg6", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libpgtypes3", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libpq-dev", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"libpq5", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-9.4-dbg", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-client-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-contrib-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-doc-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-plperl-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-plpython-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-plpython3-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-pltcl-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    if (deb_check(release:"8.0", prefix:"postgresql-server-dev-9.4", reference:"9.4.5-0+deb8u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-619.NASL
    descriptionA memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288)
    last seen2020-06-01
    modified2020-06-02
    plugin id87345
    published2015-12-15
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/87345
    titleAmazon Linux AMI : postgresql8 (ALAS-2015-619)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Amazon Linux AMI Security Advisory ALAS-2015-619.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(87345);
      script_version("2.5");
      script_cvs_date("Date: 2018/04/18 15:09:35");
    
      script_cve_id("CVE-2015-5288");
      script_xref(name:"ALAS", value:"2015-619");
      script_xref(name:"RHSA", value:"2015:2081");
    
      script_name(english:"Amazon Linux AMI : postgresql8 (ALAS-2015-619)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Amazon Linux AMI host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A memory leak error was discovered in the crypt() function of the
    pgCrypto extension. An authenticated attacker could possibly use this
    flaw to disclose a limited amount of the server memory.
    (CVE-2015-5288)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://alas.aws.amazon.com/ALAS-2015-619.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Run 'yum update postgresql8' to update your system."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-contrib");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-docs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plperl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-plpython");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-pltcl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-server");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:postgresql8-test");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2015/12/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/15");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
      script_family(english:"Amazon Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/AmazonLinux/release");
    if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
    os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
    os_ver = os_ver[1];
    if (os_ver != "A")
    {
      if (os_ver == 'A') os_ver = 'AMI';
      audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
    }
    
    if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (rpm_check(release:"ALA", reference:"postgresql8-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-contrib-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-debuginfo-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-devel-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-docs-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-libs-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-plperl-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-plpython-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-pltcl-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-server-8.4.20-4.51.amzn1")) flag++;
    if (rpm_check(release:"ALA", reference:"postgresql8-test-8.4.20-4.51.amzn1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "postgresql8 / postgresql8-contrib / postgresql8-debuginfo / etc");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-2078.NASL
    descriptionUpdated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input. (CVE-2015-5289) Please note that SSL renegotiation is now disabled by default. For more information, please refer to PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id86917
    published2015-11-19
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86917
    titleCentOS 7 : postgresql (CESA-2015:2078)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3475.NASL
    descriptionSeveral vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. - CVE-2015-5288 Josh Kupershmidt discovered a vulnerability in the crypt() function in the pgCrypto extension. Certain invalid salt arguments can cause the server to crash or to disclose a few bytes of server memory. - CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. Certain custom configuration settings (GUCs) for PL/Java will now be modifiable only by the database superuser to mitigate this issue. - CVE-2016-0773 Tom Lane and Greg Stark discovered a flaw in the way PostgreSQL processes specially crafted regular expressions. Very large character ranges in bracket expressions could cause infinite loops or memory overwrites. A remote attacker can exploit this flaw to cause a denial of service or, potentially, to execute arbitrary code.
    last seen2020-06-01
    modified2020-06-02
    plugin id88726
    published2016-02-15
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88726
    titleDebian DSA-3475-1 : postgresql-9.1 - security update
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0389-1.NASL
    descriptionThis update of postgresql91 to 9.1.19 fixes the following issues : - CVE-2015-5288: crypt() (pgCrypto extension) couldi potentially be exploited to read a few additional bytes of memory (bsc#949669) Also contains all changes and bugfixes in the upstream 9.1.19 release: http://www.postgresql.org/docs/9.1/static/release-9-1-19.html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88691
    published2016-02-11
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88691
    titleSUSE SLED11 / SLES11 Security Update : postgresql91 (SUSE-SU-2016:0389-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-329.NASL
    descriptionSeveral bugs were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS minor version contains the fixes that were applied upstream to the 9.0.22 version, backported to 8.4.22 which was the last version officially released by the PostgreSQL developers. This LTS effort for squeeze-lts is a community project sponsored by credativ GmbH. ## Migration to Version 8.4.22lts5 A dump/restore is not required for those running 8.4.X. However, if you are upgrading from a version earlier than 8.4.22, see the relevant release notes. ## Security Fixes Fix contrib/pgcrypto to detect and report too-short crypt salts (Josh Kupershmidt) Certain invalid salt arguments crashed the server or disclosed a few bytes of server memory. We have not ruled out the viability of attacks that arrange for presence of confidential information in the disclosed bytes, but they seem unlikely. (CVE-2015-5288) NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2015-10-20
    plugin id86446
    published2015-10-20
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/86446
    titleDebian DLA-329-1 : postgresql-8.4 update
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-1821-1.NASL
    descriptionThe PostreSQL database postgresql93 was updated to the bugfix release 9.3.10 : Security issues fixed : - CVE-2015-5289, bsc#949670: json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service. - CVE-2015-5288, bsc#949669: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed. For the full release notes, see: http://www.postgresql.org/docs/current/static/release-9-3-10.html Other bugs fixed : - Move systemd related stuff and user creation to postgresql-init. - Remove some obsolete %suse_version conditionals. - Relax dependency on libpq to major version. - Fix possible failure to recover from an inconsistent database state. See full release notes for details. - Fix rare failure to invalidate relation cache init file. - Avoid deadlock between incoming sessions and CREATE/DROP DATABASE. - Improve planner
    last seen2020-06-01
    modified2020-06-02
    plugin id86627
    published2015-10-28
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86627
    titleSUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:1821-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2772-1.NASL
    descriptionJosh Kupershmidt discovered the pgCrypto extension could expose several bytes of server memory if the crypt() function was provided a too-short salt. An attacker could use this flaw to read private data. (CVE-2015-5288) Oskari Saarenmaa discovered that the json and jsonb handlers could exhaust available stack space. An attacker could use this flaw to perform a denial of service attack. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-5289). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id86416
    published2015-10-16
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86416
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.04 : postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities (USN-2772-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20151119_POSTGRESQL_ON_SL7_X.NASL
    descriptionA memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input. (CVE-2015-5289) If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-03-18
    modified2015-11-20
    plugin id86992
    published2015-11-20
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86992
    titleScientific Linux Security Update : postgresql on SL7.x srpm/x86_64 (20151119)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-6D2A957A87.NASL
    descriptionupdate to 9.4.5 per release notes http://www.postgresql.org/docs/9.4/static/release-9-4-5.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-03-04
    plugin id89268
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89268
    titleFedora 22 : postgresql-9.4.5-1.fc22 (2015-6d2a957a87)
  • NASL familyDatabases
    NASL idPOSTGRESQL_20151008.NASL
    descriptionThe version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.23, 9.1.x prior to 9.1.19, 9.2.x prior to 9.2.14, 9.3.x prior to 9.3.10, or 9.4.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists due to an unspecified flaw in the crypt() function. An authenticated, remote attacker can exploit this to cause a memory leak, resulting in a denial of service condition. (CVE-2015-5288) - A denial of service vulnerability exists due to improper validation of user-supplied JSON input. An authenticated, remote attacker can exploit this, via specially crafted JSON input, to cause the server to crash. (CVE-2015-5289) - A denial of service vulnerability exists due to a flaw that is triggered when a function is executed in an outer-subtransaction cursor. An authenticated, remote attacker can exploit this to cause a denial of service condition. - Multiple stack overflow conditions exist due to improper validation of user-supplied input when handling input to record types, range types, json, jsonb, tsquery, ltxtquery and query_int. An authenticated, remote attacker can exploit this to cause a denial of service condition and potentially remote code execution. - An information disclosure vulnerability exists due to world-readable permissions granted to temporary files that are created during a pg_dump with tar-format output. A local attacker can exploit this disclose sensitive information. - An overflow condition exists due to improper validation of user-supplied input when handling SIMILAR TO and LIKE matching regular expressions. An authenticated, remote attacker can exploit this to cause a stack overflow, resulting in a denial of service condition.
    last seen2020-06-01
    modified2020-06-02
    plugin id86422
    published2015-10-16
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86422
    titlePostgreSQL 9.0.x < 9.0.23 / 9.1.x < 9.1.19 / 9.2.x < 9.2.14 / 9.3.x < 9.3.10 / 9.4.x < 9.4.5 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0482-1.NASL
    descriptionThis update of postgresql94 to 9.4.5 fixes the following issues : - CVE-2015-5289: json or jsonb input values constructed from arbitrary user input could have crashed the PostgreSQL server and caused a denial of service (bsc#949670) - CVE-2015-5288: crypt() (pgCrypto extension) couldi potentially be exploited to read a few additional bytes of memory (bsc#949669) Also contains all changes and bugfixes in the upstream 9.4.5 release: http://www.postgresql.org/docs/current/static/release-9-4-5.html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id88835
    published2016-02-18
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/88835
    titleSUSE SLED11 / SLES11 Security Update : postgresql94 (SUSE-SU-2016:0482-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-708.NASL
    descriptionpostgresql92 was updated to version 9.2.14 to fix one security issue. This security issue was fixed : - CVE-2015-5288: The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allowed attackers to cause a denial of service (server crash) or read arbitrary server memory via a
    last seen2020-06-05
    modified2015-11-06
    plugin id86777
    published2015-11-06
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86777
    titleopenSUSE Security Update : postgresql92 (openSUSE-2015-708)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-2081.NASL
    descriptionUpdated postgresql packages that fix one security issue are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) All PostgreSQL users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id86929
    published2015-11-19
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86929
    titleRHEL 6 : postgresql (RHSA-2015:2081)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-2078.NASL
    descriptionUpdated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input. (CVE-2015-5289) Please note that SSL renegotiation is now disabled by default. For more information, please refer to PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id86966
    published2015-11-20
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86966
    titleRHEL 7 : postgresql (RHSA-2015:2078)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-2081.NASL
    descriptionUpdated postgresql packages that fix one security issue are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) All PostgreSQL users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id86918
    published2015-11-19
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86918
    titleCentOS 6 : postgresql (CESA-2015:2081)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-2081.NASL
    descriptionFrom Red Hat Security Advisory 2015:2081 : Updated postgresql packages that fix one security issue are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) All PostgreSQL users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id86926
    published2015-11-19
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86926
    titleOracle Linux 6 : postgresql (ELSA-2015-2081)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-609.NASL
    descriptionMultiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values. (CVE-2015-5289) The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a
    last seen2020-06-01
    modified2020-06-02
    plugin id86771
    published2015-11-06
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/86771
    titleAmazon Linux AMI : postgresql92 / postgresql93,postgresql94 (ALAS-2015-609)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_A01825786E0011E5A90C0026551A22DC.NASL
    descriptionPostgreSQL project reports : Two security issues have been fixed in this release which affect users of specific PostgreSQL features. - CVE-2015-5289 json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service. - CVE-2015-5288: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed.
    last seen2020-06-01
    modified2020-06-02
    plugin id86320
    published2015-10-09
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86320
    titleFreeBSD : PostgreSQL -- minor security problems. (a0182578-6e00-11e5-a90c-0026551a22dc)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-0677-1.NASL
    descriptionThis update for postgresql94 fixes the following issues : - Security and bugfix release 9.4.6 : - *** IMPORTANT *** Users of version 9.4 will need to reindex any jsonb_path_ops indexes they have created, in order to fix a persistent issue with missing index entries. - Fix infinite loops and buffer-overrun problems in regular expressions (CVE-2016-0773, bsc#966436). - Fix regular-expression compiler to handle loops of constraint arcs (CVE-2007-4772). - Prevent certain PL/Java parameters from being set by non-superusers (CVE-2016-0766, bsc#966435). - Fix many issues in pg_dump with specific object types - Prevent over-eager pushdown of HAVING clauses for GROUPING SETS - Fix deparsing error with ON CONFLICT ... WHERE clauses - Fix tableoid errors for postgres_fdw - Prevent floating-point exceptions in pgbench - Make \det search Foreign Table names consistently - Fix quoting of domain constraint names in pg_dump - Prevent putting expanded objects into Const nodes - Allow compile of PL/Java on Windows - Fix
    last seen2020-06-01
    modified2020-06-02
    plugin id89730
    published2016-03-08
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/89730
    titleSUSE SLED11 / SLES11 Security Update : postgresql94 (SUSE-SU-2016:0677-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201701-33.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201701-33 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or escalate privileges. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id96474
    published2017-01-13
    reporterThis script is Copyright (C) 2017 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/96474
    titleGLSA-201701-33 : PostgreSQL: Multiple vulnerabilities
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-2078.NASL
    descriptionFrom Red Hat Security Advisory 2015:2078 : Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory. (CVE-2015-5288) A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input. (CVE-2015-5289) Please note that SSL renegotiation is now disabled by default. For more information, please refer to PostgreSQL
    last seen2020-06-01
    modified2020-06-02
    plugin id86925
    published2015-11-19
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/86925
    titleOracle Linux 7 : postgresql (ELSA-2015-2078)

Redhat

advisories
bugzilla
id1270306
titleCVE-2015-5288 postgresql: limited memory disclosure flaw in crypt()
oval
OR
  • commentRed Hat Enterprise Linux must be installed
    ovaloval:com.redhat.rhba:tst:20070304026
  • AND
    • commentRed Hat Enterprise Linux 6 is installed
      ovaloval:com.redhat.rhba:tst:20111656003
    • OR
      • AND
        • commentpostgresql-pltcl is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081001
        • commentpostgresql-pltcl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908004
      • AND
        • commentpostgresql is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081003
        • commentpostgresql is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908002
      • AND
        • commentpostgresql-contrib is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081005
        • commentpostgresql-contrib is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908008
      • AND
        • commentpostgresql-devel is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081007
        • commentpostgresql-devel is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908016
      • AND
        • commentpostgresql-server is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081009
        • commentpostgresql-server is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908020
      • AND
        • commentpostgresql-docs is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081011
        • commentpostgresql-docs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908010
      • AND
        • commentpostgresql-plpython is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081013
        • commentpostgresql-plpython is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908018
      • AND
        • commentpostgresql-plperl is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081015
        • commentpostgresql-plperl is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908012
      • AND
        • commentpostgresql-test is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081017
        • commentpostgresql-test is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908006
      • AND
        • commentpostgresql-libs is earlier than 0:8.4.20-4.el6_7
          ovaloval:com.redhat.rhsa:tst:20152081019
        • commentpostgresql-libs is signed with Red Hat redhatrelease2 key
          ovaloval:com.redhat.rhsa:tst:20100908014
rhsa
idRHSA-2015:2081
released2015-11-18
severityModerate
titleRHSA-2015:2081: postgresql security update (Moderate)
rpms
  • rh-postgresql94-postgresql-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-contrib-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-contrib-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-debuginfo-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-debuginfo-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-devel-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-devel-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-docs-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-docs-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-libs-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-libs-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-plperl-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-plperl-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-plpython-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-plpython-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-pltcl-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-pltcl-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-server-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-server-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-test-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-test-0:9.4.5-1.el7
  • rh-postgresql94-postgresql-upgrade-0:9.4.5-1.el6
  • rh-postgresql94-postgresql-upgrade-0:9.4.5-1.el7
  • postgresql-0:9.2.14-1.ael7b_1
  • postgresql-0:9.2.14-1.el7_1
  • postgresql-contrib-0:9.2.14-1.ael7b_1
  • postgresql-contrib-0:9.2.14-1.el7_1
  • postgresql-debuginfo-0:9.2.14-1.ael7b_1
  • postgresql-debuginfo-0:9.2.14-1.el7_1
  • postgresql-devel-0:9.2.14-1.ael7b_1
  • postgresql-devel-0:9.2.14-1.el7_1
  • postgresql-docs-0:9.2.14-1.ael7b_1
  • postgresql-docs-0:9.2.14-1.el7_1
  • postgresql-libs-0:9.2.14-1.ael7b_1
  • postgresql-libs-0:9.2.14-1.el7_1
  • postgresql-plperl-0:9.2.14-1.ael7b_1
  • postgresql-plperl-0:9.2.14-1.el7_1
  • postgresql-plpython-0:9.2.14-1.ael7b_1
  • postgresql-plpython-0:9.2.14-1.el7_1
  • postgresql-pltcl-0:9.2.14-1.ael7b_1
  • postgresql-pltcl-0:9.2.14-1.el7_1
  • postgresql-server-0:9.2.14-1.ael7b_1
  • postgresql-server-0:9.2.14-1.el7_1
  • postgresql-test-0:9.2.14-1.ael7b_1
  • postgresql-test-0:9.2.14-1.el7_1
  • postgresql-upgrade-0:9.2.14-1.ael7b_1
  • postgresql-upgrade-0:9.2.14-1.el7_1
  • postgresql-0:8.4.20-4.el6_7
  • postgresql-contrib-0:8.4.20-4.el6_7
  • postgresql-debuginfo-0:8.4.20-4.el6_7
  • postgresql-devel-0:8.4.20-4.el6_7
  • postgresql-docs-0:8.4.20-4.el6_7
  • postgresql-libs-0:8.4.20-4.el6_7
  • postgresql-plperl-0:8.4.20-4.el6_7
  • postgresql-plpython-0:8.4.20-4.el6_7
  • postgresql-pltcl-0:8.4.20-4.el6_7
  • postgresql-server-0:8.4.20-4.el6_7
  • postgresql-test-0:8.4.20-4.el6_7
  • postgresql92-postgresql-0:9.2.14-1.el6
  • postgresql92-postgresql-0:9.2.14-1.el7
  • postgresql92-postgresql-contrib-0:9.2.14-1.el6
  • postgresql92-postgresql-contrib-0:9.2.14-1.el7
  • postgresql92-postgresql-debuginfo-0:9.2.14-1.el6
  • postgresql92-postgresql-debuginfo-0:9.2.14-1.el7
  • postgresql92-postgresql-devel-0:9.2.14-1.el6
  • postgresql92-postgresql-devel-0:9.2.14-1.el7
  • postgresql92-postgresql-docs-0:9.2.14-1.el6
  • postgresql92-postgresql-docs-0:9.2.14-1.el7
  • postgresql92-postgresql-libs-0:9.2.14-1.el6
  • postgresql92-postgresql-libs-0:9.2.14-1.el7
  • postgresql92-postgresql-plperl-0:9.2.14-1.el6
  • postgresql92-postgresql-plperl-0:9.2.14-1.el7
  • postgresql92-postgresql-plpython-0:9.2.14-1.el6
  • postgresql92-postgresql-plpython-0:9.2.14-1.el7
  • postgresql92-postgresql-pltcl-0:9.2.14-1.el6
  • postgresql92-postgresql-pltcl-0:9.2.14-1.el7
  • postgresql92-postgresql-server-0:9.2.14-1.el6
  • postgresql92-postgresql-server-0:9.2.14-1.el7
  • postgresql92-postgresql-test-0:9.2.14-1.el6
  • postgresql92-postgresql-test-0:9.2.14-1.el7
  • postgresql92-postgresql-upgrade-0:9.2.14-1.el6
  • postgresql92-postgresql-upgrade-0:9.2.14-1.el7