PT-2009-4785 · Postgresql+1 · Postgresql+1

Tim Brown · Publicado 2009-07-07 · Atualizado 2018-10-10 · CVE-2009-2356

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NullLogic Groupware version 1.2.7

Description The issue is related to multiple stack-based buffer overflows in the pgsqlQuery function when PostgreSQL is used. This could allow remote attackers to execute arbitrary code via input to the POP3, SMTP, or web component that triggers a long SQL query.

Recommendations For NullLogic Groupware version 1.2.7, consider restricting access to the pgsqlQuery function until a patch is available. As a temporary workaround, avoid using long SQL queries in the POP3, SMTP, or web components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-2356

Produtos afetados

Nulllogic Groupware

Postgresql

Referências · 4

• http://vupen.com/english/advisories/2009/1817 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2356 · Nota de Segurança
• http://nth-dimension.org.uk/utils/get.php?downloadsid=55 · Nota
• http://securityfocus.com/archive/1/504737/100/0/threaded · Nota