PT-2010-2480 · Postgresql+1 · Postgresql+1

Bernt Marius Johnsen · Published 2010-03-19 · Updated 2023-02-13 · CVE-2010-0733

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.4.1 and earlier PostgreSQL versions 8.5 through 8.5alpha2

Description The issue is related to an integer overflow in the src/backend/executor/nodeHash.c file, which can be exploited by remote authenticated users to cause a denial of service, resulting in a daemon crash. This can be achieved by executing a SELECT statement with many LEFT JOIN clauses, affecting certain hashtable size calculations.

Recommendations For PostgreSQL versions 8.4.1 and earlier, update to a version later than 8.4.1 to resolve the issue. For PostgreSQL versions 8.5 through 8.5alpha2, update to a version later than 8.5alpha2 to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-0733

RHSA-2010:0427

RHSA-2010:0428

RHSA-2010:0429

RHSA-2010_0428

RHSA-2010_0429

Affected Products

Postgresql

Red Hat

References · 27

• 🔥 https://exploit-db.com/exploits/33729 · Exploit
• http://redhat.com/support/errata/RHSA-2010-0429.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0427.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0428.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0733 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=546621 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html · Vendor Advisory
• http://securityfocus.com/bid/37973 · Note
• http://archives.postgresql.org/pgsql-bugs/2009-10/msg00287.php · Note
• http://openwall.com/lists/oss-security/2010/03/09/2 · Note
• http://archives.postgresql.org/pgsql-bugs/2009-10/msg00310.php · Note
• https://access.redhat.com/security/cve/CVE-2009-4136 · Note
• http://openwall.com/lists/oss-security/2010/03/16/10 · Note
• https://access.redhat.com/errata/RHSA-2010:0428 · Note
• https://access.redhat.com/security/cve/CVE-2010-0733 · Note