PT-2010-2882 · Postgresql+1 · Postgresql+1
Jan Lieskovsky
·
Publicado
2010-05-19
·
Atualizado
2024-06-15
·
CVE-2010-1170
CVSS v2.0
6.0
Média
| Vetor | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions 7.4 through 7.4.28
PostgreSQL versions 8.0 through 8.0.24
PostgreSQL versions 8.1 through 8.1.20
PostgreSQL versions 8.2 through 8.2.16
PostgreSQL versions 8.3 through 8.3.10
PostgreSQL versions 8.4 through 8.4.3
PostgreSQL 9.0 Beta versions prior to 9.0 Beta 2
Description
The issue allows remote authenticated users with database-creation privileges to execute arbitrary Tcl code by creating the pltcl modules table and inserting a crafted Tcl script, due to the PL/Tcl implementation loading Tcl code from this table regardless of its ownership and permissions. Insecure permissions on the pltcl modules table could allow an authenticated user to run arbitrary Tcl code on the database server if PL/Tcl is installed and enabled.
Recommendations
For PostgreSQL versions 7.4 through 7.4.28, update to version 7.4.29 or later.
For PostgreSQL versions 8.0 through 8.0.24, update to version 8.0.25 or later.
For PostgreSQL versions 8.1 through 8.1.20, update to version 8.1.21 or later.
For PostgreSQL versions 8.2 through 8.2.16, update to version 8.2.17 or later.
For PostgreSQL versions 8.3 through 8.3.10, update to version 8.3.11 or later.
For PostgreSQL versions 8.4 through 8.4.3, update to version 8.4.4 or later.
For PostgreSQL 9.0 Beta versions prior to 9.0 Beta 2, update to version 9.0 Beta 2 or later.
As a temporary workaround, consider disabling the PL/Tcl extension until a patch is available. Restrict access to the pltcl modules table to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Postgresql
Red Hat