4 - CVE-2009-0922

Executive Summary

Informations
Name	CVE-2009-0922	First vendor Publication	2009-03-17
Vendor	Cve	Last vendor Modification	2018-10-10

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Cvss Base Score	4	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0922

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-399	Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10874

Oval ID:	oval:org.mitre.oval:def:10874
Title:	PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
Description:	PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-0922	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section postgresql is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-docs is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-pl is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-tcl is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-libs is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-contrib is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-python is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-test is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-jdbc is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-server is earlier than 0:7.4.26-1.el4_8.1 AND postgresql-devel is earlier than 0:7.4.26-1.el4_8.1 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section postgresql is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-docs is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-pl is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-tcl is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-libs is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-contrib is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-python is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-test is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-server is earlier than 0:8.1.18-2.el5_4.1 AND postgresql-devel is earlier than 0:8.1.18-2.el5_4.1

Definition Id: oval:org.mitre.oval:def:13288

Oval ID:	oval:org.mitre.oval:def:13288
Title:	USN-753-1 -- postgresql-8.1, postgresql-8.3 vulnerability
Description:	It was discovered that PostgreSQL did not properly handle encoding conversion failures. An attacker could exploit this by sending specially crafted requests to PostgreSQL, leading to a denial of service.
Family:	unix	Class:	patch
Reference(s):	USN-753-1 CVE-2009-0922	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	postgresql-8.1 postgresql-8.3
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section postgresql-doc-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-doc DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-client DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-contrib DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql DPKG is earlier than 8.3.7-0ubuntu8.04.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section postgresql-client-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND libecpg6 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND libpq-dev DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-plpython-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-contrib-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-server-dev-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND libpgtypes3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND libecpg-dev DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-pltcl-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND libpq5 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND postgresql-plperl-8.3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 AND libecpg-compat3 DPKG is earlier than 8.3.7-0ubuntu8.04.1 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND postgresql-doc-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section postgresql-client-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND postgresql-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND postgresql-contrib-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND libecpg5 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND postgresql-pltcl-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND postgresql-server-dev-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND libpgtypes2 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND libecpg-dev DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND postgresql-plpython-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND libpq4 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND libpq-dev DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND postgresql-plperl-8.1 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 AND libecpg-compat2 DPKG is earlier than 8.1.17-0ubuntu0.6.06.1 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section postgresql-doc-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-doc DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-client DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-contrib DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql DPKG is earlier than 8.3.7-0ubuntu8.10.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section postgresql-client-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND libecpg6 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND libpq-dev DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-plpython-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-contrib-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-server-dev-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND libpgtypes3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND libecpg-dev DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-pltcl-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND libpq5 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND postgresql-plperl-8.3 DPKG is earlier than 8.3.7-0ubuntu8.10.1 AND libecpg-compat3 DPKG is earlier than 8.3.7-0ubuntu8.10.1

Definition Id: oval:org.mitre.oval:def:6252

Oval ID:	oval:org.mitre.oval:def:6252
Title:	Security Vulnerability in PostgreSQL Shipped with Solaris may Allow a Denial of Service (DoS)
Description:	PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-0922	Version:	1
Platform(s):	Sun Solaris 10	Product(s):
Definition Synopsis:
Software Section Solaris 10 (SPARC) meets Sun Alert 258808 Solaris 10 (SPARC) is installed AND NOT Patch 123590-10 or later installed AND SUNWpostgr is installed OR Solaris 10 (SPARC) meets Sun Alert 258808 Solaris 10 (SPARC) is installed AND NOT Patch 136998-06 or later installed AND SUNWpostgr-82* is installed OR Solaris 10 (SPARC) meets Sun Alert 258808 Solaris 10 (SPARC) is installed AND NOT Patch 138826-04 or later installed AND SUNWpostgr-83* is installed OR Solaris 10 (x86) meets Sun Alert 258808 Solaris 10 (x86) is installed AND NOT Patch 123591-10 or later installed AND SUNWpostgr is installed OR Solaris 10 (x86) meets Sun Alert 258808 Solaris 10 (x86) is installed AND NOT Patch 136999-06 or later installed AND SUNWpostgr-82* is installed OR Solaris 10 (x86) meets Sun Alert 258808 Solaris 10 (x86) is installed AND NOT Patch 138827-04 or later installed AND SUNWpostgr-83* is installed AND Patch 136999-06 or later installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Postgresql cpe:2.3:a:postgresql:postgresql:8.3.6:::::::* cpe:2.3:a:postgresql:postgresql:8.2.12:::::::* cpe:2.3:a:postgresql:postgresql:8.1.16:::::::* cpe:2.3:a:postgresql:postgresql:8.0.20:::::::* cpe:2.3:a:postgresql:postgresql:7.4.24:::::::*	5

OpenVAS Exploits

Date	Description
2012-02-12	Name : Gentoo Security Advisory GLSA 201110-22 (postgresql-server postgresql-base) File : nvt/glsa_201110_22.nasl
2011-08-09	Name : CentOS Update for postgresql CESA-2009:1484 centos5 i386 File : nvt/gb_CESA-2009_1484_postgresql_centos5_i386.nasl
2011-08-09	Name : CentOS Update for postgresql CESA-2009:1484 centos4 i386 File : nvt/gb_CESA-2009_1484_postgresql_centos4_i386.nasl
2009-10-13	Name : RedHat Security Advisory RHSA-2009:1484 File : nvt/RHSA_2009_1484.nasl
2009-10-13	Name : SLES10: Security update for PostgreSQL File : nvt/sles10_postgresql.nasl
2009-10-13	Name : CentOS Security Advisory CESA-2009:1484 (postgresql) File : nvt/ovcesa2009_1484.nasl
2009-10-11	Name : SLES11: Security update for PostgreSQL File : nvt/sles11_postgresql.nasl
2009-10-10	Name : SLES9: Security update for PostgreSQL File : nvt/sles9p5047220.nasl
2009-09-15	Name : Fedora Core 10 FEDORA-2009-9474 (postgresql) File : nvt/fcore_2009_9474.nasl
2009-06-05	Name : RedHat Security Advisory RHSA-2009:1067 File : nvt/RHSA_2009_1067.nasl
2009-06-05	Name : Ubuntu USN-776-2 (kvm) File : nvt/ubuntu_776_2.nasl
2009-04-28	Name : SuSE Security Summary SUSE-SR:2009:009 File : nvt/suse_sr_2009_009.nasl
2009-04-24	Name : PostgreSQL Conversion Encoding Remote Denial of Service Vulnerability File : nvt/postgresql_cve_2009_0922.nasl
2009-04-15	Name : Ubuntu USN-753-1 (postgresql-8.3) File : nvt/ubuntu_753_1.nasl
2009-03-31	Name : Fedora Core 10 FEDORA-2009-2959 (postgresql) File : nvt/fcore_2009_2959.nasl
2009-03-31	Name : Mandrake Security Advisory MDVSA-2009:079 (postgresql) File : nvt/mdksa_2009_079.nasl
2009-03-31	Name : Fedora Core 9 FEDORA-2009-2927 (postgresql) File : nvt/fcore_2009_2927.nasl
2009-03-26	Name : PostgreSQL Denial of Service Vulnerability (Linux) File : nvt/secpod_postgresql_dos_vuln_lin.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
54512	PostgreSQL Client-specific Encoding Localized Error Message Conversion DoS

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1484.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20091007_postgresql_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2011-10-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201110-22.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1484.nasl - Type : ACT_GATHER_INFO
2009-10-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1484.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_postgresql-6114.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_postgresql-090324.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12383.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_postgresql-090324.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_postgresql-090324.nasl - Type : ACT_GATHER_INFO
2009-06-28	Name : The remote host is missing Sun Security Patch number 138826-12 File : solaris10_138826.nasl - Type : ACT_GATHER_INFO
2009-06-28	Name : The remote host is missing Sun Security Patch number 138827-12 File : solaris10_x86_138827.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-753-1.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-079.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Fedora host is missing a security update. File : fedora_2009-2959.nasl - Type : ACT_GATHER_INFO
2009-04-16	Name : The remote openSUSE host is missing a security update. File : suse_postgresql-6115.nasl - Type : ACT_GATHER_INFO
2009-03-24	Name : The remote Fedora host is missing a security update. File : fedora_2009-2927.nasl - Type : ACT_GATHER_INFO
2008-02-05	Name : The remote host is missing Sun Security Patch number 136999-10 File : solaris10_x86_136999.nasl - Type : ACT_GATHER_INFO
2008-02-05	Name : The remote host is missing Sun Security Patch number 136998-10 File : solaris10_136998.nasl - Type : ACT_GATHER_INFO
2007-03-18	Name : The remote host is missing Sun Security Patch number 123591-12 File : solaris10_x86_123591.nasl - Type : ACT_GATHER_INFO
2007-03-18	Name : The remote host is missing Sun Security Patch number 123590-12 File : solaris10_123590.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/34090
BUGTRAQ	http://www.securityfocus.com/archive/1/503598/100/0/threaded
CONFIRM	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517405 http://wiki.rpath.com/Advisories:rPSA-2009-0086 http://www.postgresql.org/about/news.1065 https://bugzilla.redhat.com/show_bug.cgi?id=488156
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00810.html https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00843.html
HP	http://marc.info/?l=bugtraq&m=134124585221119&w=2
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:079
MLIST	http://archives.postgresql.org//pgsql-bugs/2009-02/msg00176.php http://archives.postgresql.org/pgsql-bugs/2009-02/msg00172.php http://www.openwall.com/lists/oss-security/2009/03/11/4
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2009-1067.html
SECTRACK	http://www.securitytracker.com/id?1021860
SECUNIA	http://secunia.com/advisories/34453 http://secunia.com/advisories/35100
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-66-258808-1 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020455.1-1
SUSE	http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
VUPEN	http://www.vupen.com/english/advisories/2009/0767 http://www.vupen.com/english/advisories/2009/1316

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:09:16	Multiple Updates
2021-04-22 01:09:36	Multiple Updates
2020-05-23 00:23:29	Multiple Updates
2018-10-11 00:19:32	Multiple Updates
2017-09-29 09:24:07	Multiple Updates
2016-08-23 09:24:34	Multiple Updates
2016-04-26 18:41:59	Multiple Updates
2014-02-17 10:49:14	Multiple Updates
2013-05-10 23:46:29	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	3
CPE ID(s)	5
Sources(s)	24
osvdb(s)	1
Openvas Exploit(s)	18
Nessus® Exploit(s)	21

	Related
8.5	HPSBMU02781 SSR...
8.5	GLSA-201110-22
7.5	RHSA-2009:1067
6.5	RHSA-2009:1484
4	SUN-258808
4	MDVSA-2009:079
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 6 more Alert(s)

4 - CVE-2009-0922

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU