PT-2002-1017 · Postgresql · Ecpg+1

Publicado 2002-08-23 · Atualizado 2016-10-18 · CVE-2002-0972

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL version 7.2 ecpg (affected versions not specified)

Description The issue involves buffer overflows in PostgreSQL, potentially allowing attackers to cause a denial of service or execute arbitrary code by providing long arguments to functions such as lpad or rpad. Additionally, there are multiple vulnerabilities in the ecpg package that can lead to breaches of confidentiality, integrity, and availability of protected information, with the possibility of remote exploitation.

Recommendations For PostgreSQL version 7.2, consider restricting the use of the lpad and rpad functions until a patch is available. For ecpg, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-03115

CVE-2002-0972

DSA-165

Produtos afetados

Postgresql

Ecpg

Referências · 11

• http://redhat.com/support/errata/RHSA-2003-001.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=102987608300785&w=2 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0972 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2002-0972 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1401 · Nota de Segurança
• http://debian.org/security/dsa-165 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1402 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1400 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-03115 · Nota de Segurança
• http://secunia.com/advisories/8034 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1398 · Nota de Segurança