PT-2009-4785 · Postgresql+1 · Postgresql+1

Tim Brown · Published 2009-07-07 · Updated 2018-10-10 · CVE-2009-2356

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NullLogic Groupware version 1.2.7

Description The issue is related to multiple stack-based buffer overflows in the pgsqlQuery function when PostgreSQL is used. This could allow remote attackers to execute arbitrary code via input to the POP3, SMTP, or web component that triggers a long SQL query.

Recommendations For NullLogic Groupware version 1.2.7, consider restricting access to the pgsqlQuery function until a patch is available. As a temporary workaround, avoid using long SQL queries in the POP3, SMTP, or web components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-2356

Affected Products

Nulllogic Groupware

Postgresql

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-2356 · Security Note
• http://vupen.com/english/advisories/2009/1817 · Note
• http://nth-dimension.org.uk/utils/get.php?downloadsid=55 · Note
• http://securityfocus.com/archive/1/504737/100/0/threaded · Note