Executive Summary
| Summary | |
|---|---|
| Title | New libdbd-pg-perl packages fix potential code execution |
| Informations | |||
|---|---|---|---|
| Name | DSA-1780 | First vendor Publication | 2009-04-28 |
| Vendor | Debian | Last vendor Modification | 2009-04-28 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Two vulnerabilities have been discovered in libdbd-pg-perl, the DBI driver module for PostgreSQL database access (DBD::Pg). CVE-2009-0663 A heap-based buffer overflow may allow attackers to execute arbitrary code through applications which read rows from the database using the pg_getline and getline functions. (More common retrieval methods, such as selectall_arrayref and fetchrow_array, are not affected.) CVE-2009-1341 A memory leak in the routine which unquotes BYTEA values returned from the database allows attackers to cause a denial of service. For the old stable distribution (etch), these problems have been fixed in version 1.49-2+etch1. For the stable distribution (lenny) and the unstable distribution (sid), these problems have been fixed in version 2.1.3-1 before the release of lenny. We recommend that you upgrade your libdbd-pg-perl package. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1780 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-200 | Information Exposure |
| 50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13702 | |||
| Oval ID: | oval:org.mitre.oval:def:13702 | ||
| Title: | DSA-1780-1 libdbd-pg-perl -- several | ||
| Description: | Two vulnerabilities have been discovered in libdbd-pg-perl, the DBI driver module for PostgreSQL database access. CVE-2009-0663 A heap-based buffer overflow may allow attackers to execute arbitrary code through applications which read rows from the database using the pg_getline and getline functions. CVE-2009-1341 A memory leak in the routine which unquotes BYTEA values returned from the database allows attackers to cause a denial of service. For the old stable distribution, these problems have been fixed in version 1.49-2+etch1. For the stable distribution and the unstable distribution, these problems have been fixed in version 2.1.3-1 before the release of lenny. We recommend that you upgrade your libdbd-pg-perl package. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1780-1 CVE-2009-0663 CVE-2009-1341 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libdbd-pg-perl |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22850 | |||
| Oval ID: | oval:org.mitre.oval:def:22850 | ||
| Title: | ELSA-2009:0479: perl-DBD-Pg security update (Moderate) | ||
| Description: | Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:0479-01 CVE-2009-0663 CVE-2009-1341 | Version: | 13 |
| Platform(s): | Oracle Linux 5 | Product(s): | perl-DBD-Pg |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29079 | |||
| Oval ID: | oval:org.mitre.oval:def:29079 | ||
| Title: | RHSA-2009:0479 -- perl-DBD-Pg security update (Moderate) | ||
| Description: | An updated perl-DBD-Pg package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers. A heap-based buffer overflow flaw was discovered in the pg_getline function implementation. If the pg_getline or getline functions read large, untrusted records from a database, it could cause an application using these functions to crash or, possibly, execute arbitrary code. (CVE-2009-0663) | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:0479 CESA-2009:0479-CentOS 5 CVE-2009-0663 CVE-2009-1341 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | perl-DBD-Pg |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8139 | |||
| Oval ID: | oval:org.mitre.oval:def:8139 | ||
| Title: | DSA-1780 libdbd-pg-perl -- several vulnerabilities | ||
| Description: | Two vulnerabilities have been discovered in libdbd-pg-perl, the DBI driver module for PostgreSQL database access (DBD::Pg). A heap-based buffer overflow may allow attackers to execute arbitrary code through applications which read rows from the database using the pg_getline and getline functions. (More common retrieval methods, such as selectall_arrayref and fetchrow_array, are not affected.) A memory leak in the routine which unquotes BYTEA values returned from the database allows attackers to cause a denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1780 CVE-2009-0663 CVE-2009-1341 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | libdbd-pg-perl |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9499 | |||
| Oval ID: | oval:org.mitre.oval:def:9499 | ||
| Title: | Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows. | ||
| Description: | Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-0663 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:9680 | |||
| Oval ID: | oval:org.mitre.oval:def:9680 | ||
| Title: | Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns. | ||
| Description: | Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-1341 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for perl-DBD-Pg CESA-2009:0479 centos5 i386 File : nvt/gb_CESA-2009_0479_perl-DBD-Pg_centos5_i386.nasl |
| 2009-12-30 | Name : Mandriva Security Advisory MDVSA-2009:344 (perl-DBD-Pg) File : nvt/mdksa_2009_344.nasl |
| 2009-10-06 | Name : Mandrake Security Advisory MDVSA-2009:255 (perl-DBD-Pg) File : nvt/mdksa_2009_255.nasl |
| 2009-07-06 | Name : SuSE Security Summary SUSE-SR:2009:012 File : nvt/suse_sr_2009_012.nasl |
| 2009-06-05 | Name : RedHat Security Advisory RHSA-2009:1067 File : nvt/RHSA_2009_1067.nasl |
| 2009-05-20 | Name : RedHat Security Advisory RHSA-2009:0479 File : nvt/RHSA_2009_0479.nasl |
| 2009-05-20 | Name : CentOS Security Advisory CESA-2009:0479 (perl-DBD-Pg) File : nvt/ovcesa2009_0479.nasl |
| 2009-05-05 | Name : Debian Security Advisory DSA 1780-1 (libdbd-pg-perl) File : nvt/deb_1780_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54176 | DBD::Pg Module for Perl quote.c dequote_bytea Function Memory Consumption DoS |
| 54171 | DBD::Pg Module for Perl Multiple Function Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2009-0479.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20090513_perl_DBD_Pg_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2009-0479.nasl - Type : ACT_GATHER_INFO |
| 2009-12-29 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2009-344.nasl - Type : ACT_GATHER_INFO |
| 2009-06-17 | Name : The remote openSUSE host is missing a security update. File : suse_perl-DBD-Pg-6227.nasl - Type : ACT_GATHER_INFO |
| 2009-05-14 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2009-0479.nasl - Type : ACT_GATHER_INFO |
| 2009-04-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1780.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:28:25 |
|
