PT-2006-3279 · Postgresql+1 · Postgresql+1

Akio Ishida + 1 · Published 2006-05-23 · Updated 2018-10-18 · CVE-2006-2314

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.1.x through 8.1.3 PostgreSQL versions 8.0.x through 8.0.7 PostgreSQL versions 7.4.x through 7.4.12 PostgreSQL versions 7.3.x through 7.3.14 PostgreSQL versions prior to 7.3.15

Description The issue allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings, such as SJIS, BIG5, GBK, GB18030, and UHC. This is due to the inability of clients that do not understand multibyte encodings to handle the "" (backslash) byte 0x5c correctly when it is the trailing byte of a multibyte character. The practice of escaping ASCII single quote "'" by turning it into "'" is unsafe when operating in these multibyte encodings.

Recommendations For PostgreSQL versions 8.1.x through 8.1.3, update to version 8.1.4 or later. For PostgreSQL versions 8.0.x through 8.0.7, update to version 8.0.8 or later. For PostgreSQL versions 7.4.x through 7.4.12, update to version 7.4.13 or later. For PostgreSQL versions 7.3.x through 7.3.14, update to version 7.3.15 or later. For PostgreSQL versions prior to 7.3.15, update to version 7.3.15 or later.

Fix

Related Identifiers

CVE-2006-2314

DSA-1087-1

RHSA-2006:0526

RHSA-2006_0526

Affected Products

Postgresql

Red Hat

References · 46

• https://nvd.nist.gov/vuln/detail/CVE-2006-2314 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:098 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-2314 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_21_sr.html · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0526.html · Vendor Advisory
• http://archives.postgresql.org/pgsql-announce/2006-05/msg00010.php · Patch
• https://usn.ubuntu.com/288-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200607-04.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-2314 · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2006-Jun/0002.html · Vendor Advisory
• http://debian.org/security/2006/dsa-1087 · Vendor Advisory
• http://trustix.org/errata/2006/0032 · Vendor Advisory
• http://ubuntu.com/usn/usn-288-2 · Vendor Advisory
• http://ubuntu.com/usn/usn-288-3 · Vendor Advisory