PT-2010-2881 · Postgresql+2 · Postgresql+2

Tim Bunce · Published 2010-05-19 · Updated 2024-06-15 · CVE-2010-1169

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 7.4 through 7.4.28 PostgreSQL versions 8.0 through 8.0.24 PostgreSQL versions 8.1 through 8.1.20 PostgreSQL versions 8.2 through 8.2.16 PostgreSQL versions 8.3 through 8.3.10 PostgreSQL versions 8.4 through 8.4.3 PostgreSQL version 9.0 Beta before 9.0 Beta 2

Description The issue is related to the improper restriction of PL/perl procedures, allowing remote authenticated users with database-creation privileges to execute arbitrary Perl code via a crafted script. This is related to the Safe module (aka Safe.pm) for Perl. An authenticated user can run arbitrary Perl code on the database server if PL/Perl is installed and enabled.

Recommendations For PostgreSQL versions 7.4 through 7.4.28, update to version 7.4.29 or later. For PostgreSQL versions 8.0 through 8.0.24, update to version 8.0.25 or later. For PostgreSQL versions 8.1 through 8.1.20, update to version 8.1.21 or later. For PostgreSQL versions 8.2 through 8.2.16, update to version 8.2.17 or later. For PostgreSQL versions 8.3 through 8.3.10, update to version 8.3.11 or later. For PostgreSQL versions 8.4 through 8.4.3, update to version 8.4.4 or later. For PostgreSQL version 9.0 Beta before 9.0 Beta 2, update to version 9.0 Beta 2 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-1169

DSA-2051-1

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

RHSA-2010:0427

RHSA-2010:0428

RHSA-2010:0429

RHSA-2010:0430

RHSA-2010_0428

RHSA-2010_0429

RHSA-2010_0430

Affected Products

Perl

Postgresql

Red Hat

References · 98

• http://marc.info/?l=bugtraq&m=134124585221119&w=2 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0428.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041559.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10030-1 · Vendor Advisory
• http://secunia.com/advisories/39845 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10256-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:103 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041579.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041591.html · Vendor Advisory
• http://vupen.com/english/advisories/2010/1167 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0429.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1169 · Security Note
• http://debian.org/security/2010/dsa-2051 · Vendor Advisory
• http://postgresql.org/about/news.1203 · Patch