PT-2012-2919 · Postgresql+3 · Postgresql+3

Robert Haas

·

Publicado

2012-05-21

·

Atualizado

2024-06-15

·

CVE-2012-0866

CVSS v2.0

6.5

Média

VetorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.3.x through 8.3.17 PostgreSQL versions 8.4.x through 8.4.10 PostgreSQL versions 9.0.x through 9.0.6 PostgreSQL versions 9.1.x through 9.1.2
Description The issue concerns the CREATE TRIGGER function in PostgreSQL, which does not properly check the execute permission for trigger functions marked as SECURITY DEFINER. This allows remote authenticated users to execute restricted triggers on arbitrary data by installing the trigger on a table owned by the attacker. The problem lies in the improper checking of permissions on functions called by triggers.
Recommendations For PostgreSQL versions 8.3.x through 8.3.17, update to version 8.3.18 or later. For PostgreSQL versions 8.4.x through 8.4.10, update to version 8.4.11 or later. For PostgreSQL versions 9.0.x through 9.0.6, update to version 9.0.7 or later. For PostgreSQL versions 9.1.x through 9.1.2, update to version 9.1.3 or later.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

CESA-2012_0678
CVE-2012-0866
DSA-2418-1
OPENSUSE-SU-2024:10030-1
OPENSUSE-SU-2024:10256-1
OPENSUSE-SU-2024:10273-1
RHSA-2012:0677
RHSA-2012:0678
RHSA-2012_0677
RHSA-2012_0678
SUSE-SU-2012_0700-1
SUSE-SU-2012_0702-1

Produtos afetados

Centos
Postgresql
Red Hat
Suse