PT-2002-1017 · Postgresql · Ecpg+1

Published 2002-08-23 · Updated 2016-10-18 · CVE-2002-0972

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL version 7.2 ecpg (affected versions not specified)

Description The issue involves buffer overflows in PostgreSQL, potentially allowing attackers to cause a denial of service or execute arbitrary code by providing long arguments to functions such as lpad or rpad. Additionally, there are multiple vulnerabilities in the ecpg package that can lead to breaches of confidentiality, integrity, and availability of protected information, with the possibility of remote exploitation.

Recommendations For PostgreSQL version 7.2, consider restricting the use of the lpad and rpad functions until a patch is available. For ecpg, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-03115

CVE-2002-0972

DSA-165

Affected Products

Postgresql

Ecpg

References · 11

• http://redhat.com/support/errata/RHSA-2003-001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0972 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2002-0972 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1401 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1402 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1400 · Security Note
• https://bdu.fstec.ru/vul/2015-03115 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1398 · Security Note
• http://marc.info/?l=bugtraq&m=102987608300785&w=2 · Note
• http://debian.org/security/dsa-165 · Note
• http://secunia.com/advisories/8034 · Note