PT-2010-2206 · Postgresql+1 · Postgresql+1
David Kovalsky
·
Published
2010-02-02
·
Updated
2023-02-24
·
CVE-2010-0442
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions 8.0.23 through 8.3.8
Description
The issue allows remote authenticated users to cause a denial of service or have unspecified other impact via vectors involving a negative integer in the third argument of the
bitsubstr function in backend/utils/adt/varbit.c, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."Recommendations
For versions 8.0.23, 8.1.11, and 8.3.8, consider disabling the
bitsubstr function in backend/utils/adt/varbit.c to prevent exploitation until a patch is available.
Restrict access to the substring function for bit strings to minimize the risk of denial of service or other impacts.
Avoid using negative integers in the third argument of the bitsubstr function to prevent potential overflows.Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Postgresql
Red Hat