PT-2002-1021 · Postgresql+1 · Ecpg+2

Published 2002-09-24 · Updated 2016-10-18 · CVE-2002-1402

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 7.2.1 and earlier ecpg (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the ecpg package of Debian GNU/Linux and buffer overflows in PostgreSQL. These vulnerabilities can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, buffer overflows in the TZ and SET TIME ZONE environment variables can cause a denial of service and possibly allow the execution of arbitrary code.

Recommendations For PostgreSQL versions 7.2.1 and earlier: update to a version later than 7.2.1 to resolve the buffer overflow issues in the TZ and SET TIME ZONE environment variables. For ecpg: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-03115

CVE-2002-1402

DSA-165

Affected Products

Debian

Postgresql

Ecpg

References · 16

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000524 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-001.html · Vendor Advisory
• http://debian.org/security/2002/dsa-165 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0972 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1401 · Security Note
• http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2002:062 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1402 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1400 · Security Note
• https://bdu.fstec.ru/vul/2015-03115 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1398 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2002-1402 · Security Note
• http://debian.org/security/dsa-165 · Note
• http://marc.info/?l=bugtraq&m=103021186622725&w=2 · Note
• http://marc.info/?l=bugtraq&m=103036987114437&w=2 · Note