PT-2014-3462 · Postgresql+1 · Postgresql+1

Published 2014-03-28 · Updated 2024-06-15 · CVE-2014-0067

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.3.3 and earlier

Description The issue allows local users to gain privileges by leveraging access to a database cluster used for test suites. This is due to the "make check" command not properly invoking initdb to specify authentication requirements for the cluster. Unauthenticated users may gain access to the database server during the "make check" process.

Recommendations For PostgreSQL versions 9.3.3 and earlier, consider restricting access to the database cluster used for test suites until a proper fix is applied. As a temporary workaround, ensure that only authorized users have access to the "make check" command to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-0067

DLA-0019-1

DSA-2864-1

DSA-2865-1

MGASA-2014-0205

MGASA-2014-0222

OPENSUSE-SU-2024:10030-1

OPENSUSE-SU-2024:10256-1

OPENSUSE-SU-2024:10273-1

Affected Products

Postgresql

Suse

References · 74

• https://osv.dev/vulnerability/MGASA-2014-0222 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0205 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10030-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0222.html · Security Note
• http://debian.org/security/2014/dsa-2864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0067 · Security Note
• https://advisories.mageia.org/MGASA-2014-0205.html · Security Note
• http://debian.org/security/2014/dsa-2865 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0067 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10256-1 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-0067 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10273-1 · Vendor Advisory