PT-2006-3278 · Postgresql+1 · Postgresql+1

Akio Ishida + 1 · Published 2006-05-23 · Updated 2018-10-18 · CVE-2006-2313

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 8.1.4 PostgreSQL versions prior to 8.0.8 PostgreSQL versions prior to 7.4.13 PostgreSQL versions prior to 7.3.15

Description The issue allows context-dependent attackers to bypass SQL injection protection methods in applications via invalid encodings of multibyte characters. An attacker able to submit crafted strings to an application that will embed those strings in SQL commands can use invalidly-encoded multibyte characters to bypass standard string-escaping methods, resulting in possible SQL injection.

Recommendations For versions prior to 8.1.4, update to version 8.1.4 or later. For versions prior to 8.0.8, update to version 8.0.8 or later. For versions prior to 7.4.13, update to version 7.4.13 or later. For versions prior to 7.3.15, update to version 7.3.15 or later.

Fix

Related Identifiers

CVE-2006-2313

DSA-1087-1

RHSA-2006:0526

RHSA-2006_0526

Affected Products

Postgresql

Red Hat

References · 38

• ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:098 · Vendor Advisory
• http://debian.org/security/2006/dsa-1087 · Vendor Advisory
• http://archives.postgresql.org/pgsql-announce/2006-05/msg00010.php · Patch
• http://redhat.com/support/errata/RHSA-2006-0526.html · Vendor Advisory
• http://ubuntu.com/usn/usn-288-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2313 · Security Note
• http://trustix.org/errata/2006/0032 · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2006-Jun/0002.html · Vendor Advisory
• https://usn.ubuntu.com/288-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200607-04.xml · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2006-2313 · Note
• http://securityfocus.com/archive/1/435038/100/0/threaded · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10618 · Note
• https://postgresql.org/support/security · Note