PT-2013-3458 · Postgresql · Postgresql

Marko Kreen · Published 2013-04-04 · Updated 2017-10-20 · CVE-2013-1903

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 8.3.x through 8.3.22 PostgreSQL versions 8.4.x through 8.4.16 PostgreSQL versions 9.0.x through 9.0.12 PostgreSQL versions 9.1.x through 9.1.8 PostgreSQL versions 9.2.x through 9.2.3

Description The issue incorrectly provides the superuser password to scripts related to graphical installers for Linux and Mac OS X, which has unspecified impact and attack vectors.

Recommendations For PostgreSQL versions 8.3.x through 8.3.22, update to version 8.3.23 or later. For PostgreSQL versions 8.4.x through 8.4.16, update to version 8.4.17 or later. For PostgreSQL versions 9.0.x through 9.0.12, update to version 9.0.13 or later. For PostgreSQL versions 9.1.x through 9.1.8, update to version 9.1.9 or later. For PostgreSQL versions 9.2.x through 9.2.3, update to version 9.2.4 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-1903

Affected Products

Postgresql

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-1903 · Security Note
• http://postgresql.org/support/security · Vendor Advisory
• http://postgresql.org/about/news/1456 · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Note