PT-2014-3458 · Postgresql+3 · Postgresql+3
Andres Freund
·
Publicado
2014-02-21
·
Atualizado
2024-06-15
·
CVE-2014-0062
CVSS v2.0
4.9
Média
| Vetor | AV:N/AC:M/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions prior to 8.4.20
PostgreSQL versions 9.0.x prior to 9.0.16
PostgreSQL versions 9.1.x prior to 9.1.12
PostgreSQL versions 9.2.x prior to 9.2.7
PostgreSQL versions 9.3.x prior to 9.3.3
Description
A race condition exists in the CREATE INDEX and ALTER TABLE commands, allowing remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window. This issue can also lead to privilege escalation.
Recommendations
For versions prior to 8.4.20, update to version 8.4.20 or later.
For versions 9.0.x prior to 9.0.16, update to version 9.0.16 or later.
For versions 9.1.x prior to 9.1.12, update to version 9.1.12 or later.
For versions 9.2.x prior to 9.2.7, update to version 9.2.7 or later.
For versions 9.3.x prior to 9.3.3, update to version 9.3.3 or later.
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Postgresql
Red Hat
Suse