PT-2007-2016 · Postgresql+1 · Postgresql+1

Publicado 2007-02-06 · Atualizado 2018-10-16 · CVE-2007-0556

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:N/AC:H/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 8.0.11 PostgreSQL versions prior to 8.1.7 PostgreSQL versions prior to 8.2.2

Description The issue arises from the query planner not verifying table compatibility with previously made query plans. This allows remote authenticated users to potentially cause a denial of service (server crash) and access database content they should not have access to. The vulnerability can be exploited through an "ALTER COLUMN TYPE" SQL statement, which may enable reading arbitrary memory from the server.

Recommendations For versions prior to 8.0.11, update to version 8.0.11 or later. For versions prior to 8.1.7, update to version 8.1.7 or later. For versions prior to 8.2.2, update to version 8.2.2 or later.

Correção

Identificadores relacionados

CVE-2007-0556

RHSA-2007:0067

RHSA-2007:0068

RHSA-2007_0068

Produtos afetados

Postgresql

Red Hat

Referências · 45

• http://secunia.com/advisories/24057 · Nota
• https://postgresql.org/support/security · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0556 · Nota
• http://secunia.com/advisories/24042 · Nota
• http://fedoranews.org/cms/node/2554 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2007-0555 · Nota
• http://securityfocus.com/archive/1/459280/100/0/threaded · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11353 · Nota
• http://vupen.com/english/advisories/2007/0774 · Nota
• http://secunia.com/advisories/24513 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102825-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2007-0556 · Nota
• http://vupen.com/english/advisories/2007/0478 · Nota
• http://secunia.com/advisories/24151 · Nota
• http://osvdb.org/33302 · Nota