PT-2009-5547 · Postgresql · Postgresql

Tomas Hoger

·

Published

2009-09-17

·

Updated

2024-02-13

·

CVE-2009-3231

CVSS v2.0

6.8

Medium

VectorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.2 through 8.2.14 PostgreSQL versions 8.3 through 8.3.8
Description The issue allows remote attackers to bypass authentication via an empty password when using LDAP authentication with anonymous binds. If PostgreSQL is configured with LDAP authentication and the LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.
Recommendations For PostgreSQL versions 8.2 through 8.2.14, update to version 8.2.14 or later to resolve the issue. For PostgreSQL versions 8.3 through 8.3.8, update to version 8.3.8 or later to resolve the issue. As a temporary workaround, consider disabling LDAP authentication with anonymous binds until a patch is available. Restrict access to the LDAP configuration to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-3231
DSA-1900-1
RHSA-2009:1461

Affected Products

Postgresql