PT-2009-5546 · Postgresql+1 · Postgresql+1

Tomas Hoger · Published 2009-09-17 · Updated 2018-10-10 · CVE-2009-3230

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 7.4 through 7.4.25 PostgreSQL versions 8.0 through 8.0.21 PostgreSQL versions 8.1 through 8.1.17 PostgreSQL versions 8.2 through 8.2.13 PostgreSQL versions 8.3 through 8.3.7 PostgreSQL versions 8.4 through 8.4.0

Description The core server component in PostgreSQL does not use the appropriate privileges for the RESET ROLE and RESET SESSION AUTHORIZATION operations, allowing remote authenticated users to gain privileges. This issue is due to an incomplete fix for a previous problem.

Recommendations For PostgreSQL versions 7.4 through 7.4.25, update to version 7.4.26 or later. For PostgreSQL versions 8.0 through 8.0.21, update to version 8.0.22 or later. For PostgreSQL versions 8.1 through 8.1.17, update to version 8.1.18 or later. For PostgreSQL versions 8.2 through 8.2.13, update to version 8.2.14 or later. For PostgreSQL versions 8.3 through 8.3.7, update to version 8.3.8 or later. For PostgreSQL versions 8.4 through 8.4.0, update to version 8.4.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-3230

DSA-1900-1

RHSA-2009:1461

RHSA-2009:1484

RHSA-2009:1485

RHSA-2009_1484

Affected Products

Postgresql

Red Hat

References · 33

• http://postgresql.org/support/security.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-September/msg00305.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/2602 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-September/msg00307.html · Vendor Advisory
• http://ubuntu.com/usn/usn-834-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html · Vendor Advisory
• http://us.debian.org/security/2009/dsa-1900 · Vendor Advisory
• http://secunia.com/advisories/36695 · Vendor Advisory
• http://secunia.com/advisories/36660 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html · Vendor Advisory
• http://secunia.com/advisories/36727 · Vendor Advisory
• http://postgresql.org/docs/8.3/static/release-8-3-8.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=134124585221119&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3230 · Security Note