PT-2003-1150 · Postgresql · Postgresql

Published 2003-01-08 · Updated 2017-07-11 · CVE-2002-1397

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 7.2

Description The issue concerns a problem in the cash words() function that can be exploited by local users to cause a denial of service and potentially execute arbitrary code. This is achieved by passing a large negative argument, which may trigger an integer signedness error or buffer overflow.

Recommendations For versions prior to 7.2, consider disabling the cash words() function as a temporary workaround until a patch is available. Restrict access to this function to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1397

Affected Products

Postgresql

References · 8

• http://redhat.com/support/errata/RHSA-2003-001.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1397 · Security Note
• http://developer.postgresql.org/cvsweb.cgi/pgsql-server/src/backend/utils/adt/cash.c.diff?r1=1.51&r2=1.52 · Note
• http://marc.info/?l=bugtraq&m=102977465204357&w=2 · Note
• http://secunia.com/advisories/8034 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/9891 · Note
• http://securityfocus.com/bid/5497 · Note