PT-2014-3458 · Postgresql+3 · Postgresql+3
Andres Freund
·
Published
2014-02-21
·
Updated
2024-06-15
·
CVE-2014-0062
CVSS v2.0
4.9
Medium
| Vector | AV:N/AC:M/Au:S/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions prior to 8.4.20
PostgreSQL versions 9.0.x prior to 9.0.16
PostgreSQL versions 9.1.x prior to 9.1.12
PostgreSQL versions 9.2.x prior to 9.2.7
PostgreSQL versions 9.3.x prior to 9.3.3
Description
A race condition exists in the CREATE INDEX and ALTER TABLE commands, allowing remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window. This issue can also lead to privilege escalation.
Recommendations
For versions prior to 8.4.20, update to version 8.4.20 or later.
For versions 9.0.x prior to 9.0.16, update to version 9.0.16 or later.
For versions 9.1.x prior to 9.1.12, update to version 9.1.12 or later.
For versions 9.2.x prior to 9.2.7, update to version 9.2.7 or later.
For versions 9.3.x prior to 9.3.3, update to version 9.3.3 or later.
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Postgresql
Red Hat
Suse