PT-2019-4748 · Postgresql+1 · Postgresql-Common+1
Rich Mirch
·
Publicado
2019-11-14
·
Atualizado
2019-12-03
·
CVE-2019-3466
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
postgresql-common versions prior to 210
Description
The issue is related to the pg ctlcluster script in postgresql-common, which failed to drop privileges when creating temporary directories for sockets and statistics. This could lead to local privilege escalation. An attacker could exploit this issue to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations
For versions prior to 210, update to version 210 or later to resolve the issue. As a temporary workaround, consider restricting access to the pg ctlcluster script to minimize the risk of exploitation.
Exploit
Correção
LPE
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ubuntu
Postgresql-Common