PT-2005-1308 · Postgresql+1 · Postgresql+1

John Heasman · Published 2005-02-06 · Updated 2023-10-18 · CVE-2005-0227

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 7.2.x through 7.4.x PostgreSQL (affected versions not specified)

Description The issue allows local users to load arbitrary shared libraries and execute code via the LOAD extension. Any database user is permitted to load arbitrary shared libraries using the LOAD command. A valid login is required to exploit this issue.

Recommendations For versions 7.2.x through 7.4.x, consider restricting access to the LOAD command to prevent arbitrary shared library loading. As a temporary workaround, consider disabling the LOAD extension until a patch is available. Restrict database user permissions to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2005-0227

DSA-668-1

RHSA-2005:138

RHSA-2005:141

RHSA-2005_138

RHSA-2005_141

Affected Products

Postgresql

Red Hat

References · 27

• http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-150.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200502-08.xml · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_36_sudo.html · Vendor Advisory
• http://debian.org/security/2005/dsa-668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0227 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2005:040 · Vendor Advisory
• http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php · Vendor Advisory
• https://redhat.com/security/data/cve/CVE-2005-0245.html · Note
• http://redhat.com/support/errata/RHSA-2005-138.html · Patch, Vendor Advisory
• https://postgresql.org · Note
• http://securityfocus.com/bid/12411 · Note
• https://redhat.com/security/data/cve/CVE-2005-0244.html · Note
• http://archives.postgresql.org/pgsql-patches/2005-01/msg00216.php · Note
• http://trustix.org/errata/2005/0003 · Patch, Vendor Advisory