PT-2010-3596 · Postgresql+1 · Postgresql+1

Publicado 2010-05-19 · Atualizado 2017-09-19 · CVE-2010-1975

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 7.4 through 7.4.28 PostgreSQL versions 8.0 through 8.0.24 PostgreSQL versions 8.1 through 8.1.20 PostgreSQL versions 8.2 through 8.2.16 PostgreSQL versions 8.3 through 8.3.10 PostgreSQL versions 8.4 through 8.4.3

Description The issue allows remote authenticated users to remove arbitrary parameter settings via certain statements, effectively bypassing settings that should be enforced. An unprivileged database user can exploit this to remove superuser-only settings applied to their account, which were set by a superuser using ALTER USER.

Recommendations For PostgreSQL versions 7.4 through 7.4.28, update to version 7.4.29 or later. For PostgreSQL versions 8.0 through 8.0.24, update to version 8.0.25 or later. For PostgreSQL versions 8.1 through 8.1.20, update to version 8.1.21 or later. For PostgreSQL versions 8.2 through 8.2.16, update to version 8.2.17 or later. For PostgreSQL versions 8.3 through 8.3.10, update to version 8.3.11 or later. For PostgreSQL versions 8.4 through 8.4.3, update to version 8.4.4 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-1975

DSA-2051-1

RHSA-2010:0428

RHSA-2010:0429

RHSA-2010:0430

RHSA-2010_0428

RHSA-2010_0429

RHSA-2010_0430

RHSA-2026:8756

Produtos afetados

Postgresql

Red Hat

Referências · 20

• http://debian.org/security/2010/dsa-2051 · Aviso do Fabricante
• https://postgresql.org · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1975 · Nota
• http://postgresql.org/docs/current/static/release-8-2-17.html · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2010:103 · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/1221 · Nota
• http://secunia.com/advisories/39939 · Nota
• http://postgresql.org/docs/current/static/release-7-4-29.html · Nota
• https://postgresql.org/support/security/CVE-2010-1975 · Nota
• http://postgresql.org/docs/current/static/release-8-0-25.html · Nota
• https://postgresql.org/support/security · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11004 · Nota
• http://marc.info/?l=bugtraq&m=134124585221119&w=2 · Aviso do Fabricante
• http://postgresql.org/docs/current/static/release-8-1-21.html · Nota
• http://postgresql.org/docs/current/static/release-8-4-4.html · Nota