VRDA Feed by JPCERT/CC
  Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis
[ about VRDA Feed | JPCERT/CC ] 



 
Vulnerability Analysis Result (Revision No : 1) [ Download XML ] 
VRDA-091217-004
PostgreSQL Security Bypass and Privilege Escalation Vulnerabilities
http://www.postgresql.org/about/news.1170

The PostgreSQL Project today released minor versions updating all active branches of the PostgreSQL object-relational database system, including versions 8.4.2, 8.3.9, 8.2.15, 8.1.19, 8.0.23, and 7.4.27. This release fixes one moderate-risk and one low-risk security issue: an SSL authentication issue, and a privilege escalation issue with expression indexes. All PostgreSQL database administrators are urged to update your version of PostgreSQL at the earliest opportunity.




About This Analysis Information
Analysis Information Provider:
 		JPCERT/CC
 		First Published:
 		2009-12-17
Source Information Category:
 		Advisory, Alert
 		Last Updated:
 		2009-12-17




Affected Product Tags
lapt:/a:postgresql:postgresql
 


Vulnerability Analysis Results
[Information Source Reliability] [?]
Low [?]

Medium [?]
X High [?]
[Impact Level] [?]
Low [?]

Low-Medium [?]
X Medium-High [?]
High [?]
[Access Required] [?]
Physical [?]

Local [?]
X Non-routed [?]
Routed [?]
[Authentication] [?]
Privileged [?]

Standard [?]
Limited [?]
X None or Unnecessary [?]
[User Interaction Required] [?]
X Complex [?]

Simple [?]
None [?]
[Technical Difficulty] [?]
High [?]

Medium-High [?]
Low-Medium [?]
Low [?]
[Availability of Remediation] [?]
X Official Patch [?]

Official Workaround [?]
Unofficial Patch [?]
None [?]
[Incident Activity] [?]
X None [?]

Exploit or PoC [?]
Activity Observed [?]
Alternatives




References
Common Vulnerabilities and Exposures (CVE) CVE-2009-4034
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before8.4.2 does not properly handle a '\0' character in a domain name inthe subject's Common Name (CN) field of an X.509 certificate, which(1) allows man-in-the-middle attackers to spoof arbitrary SSL-basedPostgreSQL servers via a crafted server certificate issued by alegitimate Certification Authority, and (2) allows remote attackers tobypass intended client-hostname restrictions via a crafted clientcertificate issued by a legitimate Certification Authority, a relatedissue to CVE-2009-2408.




Common Vulnerabilities and Exposures (CVE) CVE-2009-4136
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before8.4.2 does not properly manage session-local state during execution ofan index function by a database superuser, which allows remoteauthenticated users to gain privileges via a table with crafted indexfunctions, as demonstrated by functions that modify (1) search_path or(2) a prepared statement, a related issue to CVE-2007-6600 andCVE-2009-3230.




Copyright © 2009 JPCERT/CC All Rights Reserved.