PT-2013-6353 · Postgresql+1 · Postgresql+1

Noah Misch · Published 1970-01-01 · Updated 2024-06-15 · CVE-2013-1901

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.2.x through 9.2.3 PostgreSQL versions 9.1.x through 9.1.8

Description The issue allows remote authenticated users to bypass intended backup restrictions. This can be achieved by calling the (1) pg start backup or (2) pg stop backup functions. An unprivileged user can run commands that could interfere with in-progress backups. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information and can be exploited remotely by an authenticated attacker.

Recommendations For PostgreSQL versions 9.2.x through 9.2.3, update to version 9.2.4 or later. For PostgreSQL versions 9.1.x through 9.1.8, update to version 9.1.9 or later. As a temporary workaround, consider restricting access to the pg start backup and pg stop backup functions until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-264

CWE-94

Related Identifiers

BDU:2015-04511

BDU:2015-04512

BDU:2015-04513

BDU:2015-04514

CVE-2013-1901

DSA-2658-1

OPENSUSE-SU-2013_0627-1

OPENSUSE-SU-2013_0628-1

OPENSUSE-SU-2013_0635-1

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

Affected Products

Postgresql

Suse

References · 81

• http://debian.org/security/2013/dsa-2658 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04511 · Security Note
• https://bdu.fstec.ru/vul/2015-04513 · Security Note
• http://ubuntu.com/usn/USN-1789-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10030-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1901 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10256-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04512 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:142 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory