PT-2010-3128 · Perl+2 · Perl+2

Published 2010-05-19 · Updated 2017-09-19 · CVE-2010-1447

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 7.4 through 7.4.28 PostgreSQL versions 8.0 through 8.0.24 PostgreSQL versions 8.1 through 8.1.20 PostgreSQL versions 8.2 through 8.2.16 PostgreSQL versions 8.3 through 8.3.10 PostgreSQL versions 8.4 through 8.4.3 PostgreSQL version 9.0 Beta through 9.0 Beta 1

Description The issue concerns the Safe module for Perl, which is used in PostgreSQL. It does not properly restrict PL/perl procedures, allowing remote attackers to execute arbitrary Perl code through a manipulated script. This is related to the Safe module, also known as Safe.pm, which allows context-dependent attackers to bypass access restrictions and inject code via vectors involving subroutine references and delayed execution.

Recommendations For PostgreSQL versions 7.4 through 7.4.28, update to version 7.4.29 or later. For PostgreSQL versions 8.0 through 8.0.24, update to version 8.0.25 or later. For PostgreSQL versions 8.1 through 8.1.20, update to version 8.1.21 or later. For PostgreSQL versions 8.2 through 8.2.16, update to version 8.2.17 or later. For PostgreSQL versions 8.3 through 8.3.10, update to version 8.3.11 or later. For PostgreSQL versions 8.4 through 8.4.3, update to version 8.4.4 or later. For PostgreSQL version 9.0 Beta through 9.0 Beta 1, update to version 9.0 Beta 2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-1447

DSA-2051-1

DSA-2267-1

RHSA-2010:0457

RHSA-2010:0458

RHSA-2010_0457

RHSA-2010_0458

Affected Products

Perl

Postgresql

Red Hat

References · 34

• https://security-tracker.debian.org/tracker/CVE-2010-1447 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0458.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0457.html · Vendor Advisory
• http://secunia.com/advisories/39845 · Vendor Advisory
• http://debian.org/security/2011/dsa-2267 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-1447 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:116 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02556 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1447 · Vendor Advisory
• http://vupen.com/english/advisories/2010/1167 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1447 · Security Note
• http://gossamer-threads.com/lists/perl/porters/233695#233695 · Note
• https://access.redhat.com/errata/RHSA-2010:0457 · Note
• http://openwall.com/lists/oss-security/2010/05/20/5 · Note