PT-2019-4748 · Postgresql+1 · Postgresql-Common+1

Rich Mirch · Published 2019-11-14 · Updated 2019-12-03 · CVE-2019-3466

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions postgresql-common versions prior to 210

Description The issue is related to the pg ctlcluster script in postgresql-common, which failed to drop privileges when creating temporary directories for sockets and statistics. This could lead to local privilege escalation. An attacker could exploit this issue to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 210, update to version 210 or later to resolve the issue. As a temporary workaround, consider restricting access to the pg ctlcluster script to minimize the risk of exploitation.

Exploit

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-01320

CVE-2019-3466

DLA-1994-1

DSA-4568-1

ECHO-CF16-1305-6C35

USN-4194-1

USN-4194-2

Affected Products

Ubuntu

Postgresql-Common

References · 26

• 🔥 https://blog.mirch.io/2019/11/15/cve-2019-3466-debian-ubuntu-pg_ctlcluster-privilege-escalation · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3466 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3466 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2019-3466 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4194-2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20201207SE16MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3466 · Security Note
• https://usn.ubuntu.com/4194-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4194-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3466 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4194-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-3466 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1994-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory