PT-2013-3458 · Postgresql · Postgresql

Marko Kreen · Publicado 2013-04-04 · Atualizado 2017-10-20 · CVE-2013-1903

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.3.x through 8.3.22 PostgreSQL versions 8.4.x through 8.4.16 PostgreSQL versions 9.0.x through 9.0.12 PostgreSQL versions 9.1.x through 9.1.8 PostgreSQL versions 9.2.x through 9.2.3

Description The issue incorrectly provides the superuser password to scripts related to graphical installers for Linux and Mac OS X, which has unspecified impact and attack vectors.

Recommendations For PostgreSQL versions 8.3.x through 8.3.22, update to version 8.3.23 or later. For PostgreSQL versions 8.4.x through 8.4.16, update to version 8.4.17 or later. For PostgreSQL versions 9.0.x through 9.0.12, update to version 9.0.13 or later. For PostgreSQL versions 9.1.x through 9.1.8, update to version 9.1.9 or later. For PostgreSQL versions 9.2.x through 9.2.3, update to version 9.2.4 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-1903

Produtos afetados

Postgresql

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-1903 · Nota de Segurança
• http://postgresql.org/support/security · Aviso do Fabricante
• http://postgresql.org/about/news/1456 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Nota