PT-2007-2016 · Postgresql+1 · Postgresql+1

Published 2007-02-06 · Updated 2018-10-16 · CVE-2007-0556

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:N/AC:H/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 8.0.11 PostgreSQL versions prior to 8.1.7 PostgreSQL versions prior to 8.2.2

Description The issue arises from the query planner not verifying table compatibility with previously made query plans. This allows remote authenticated users to potentially cause a denial of service (server crash) and access database content they should not have access to. The vulnerability can be exploited through an "ALTER COLUMN TYPE" SQL statement, which may enable reading arbitrary memory from the server.

Recommendations For versions prior to 8.0.11, update to version 8.0.11 or later. For versions prior to 8.1.7, update to version 8.1.7 or later. For versions prior to 8.2.2, update to version 8.2.2 or later.

Fix

Related Identifiers

CVE-2007-0556

RHSA-2007:0067

RHSA-2007:0068

RHSA-2007_0068

Affected Products

Postgresql

Red Hat

References · 45

• http://fedoranews.org/cms/node/2554 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102825-1 · Vendor Advisory
• https://usn.ubuntu.com/417-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0067.html · Vendor Advisory
• http://trustix.org/errata/2007/0007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0556 · Security Note
• http://redhat.com/support/errata/RHSA-2007-0068.html · Vendor Advisory
• http://ubuntu.com/usn/usn-417-2 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_10_sr.html · Vendor Advisory
• http://secunia.com/advisories/24033 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:037 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200703-15.xml · Vendor Advisory
• http://secunia.com/advisories/24057 · Note
• https://postgresql.org/support/security · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0556 · Note