Executive Summary

Summary
Title Sun Alert 274870 Security Vulnerabilities in PostgreSQL Shipped With Solaris May Allow Escalation of Privileges or Man-in-the-Middle on SSL Connections
Informations
Name SUN-274870 First vendor Publication 2009-12-24
Vendor Sun Last vendor Modification 2010-01-19
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score 6.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Product: Solaris 10, OpenSolaris

Multiple security vulnerabilities have been identified in thePostgreSQL software shipped with Solaris. These vulnerabilities mayallow a remote authenticated user with certain privileges to gain extraprivileges via a table with a crafted index function. Furthervulnerabilities may allow man-in-the-middle attacks on SSL basedPostgreSQL servers by substituting malicious SSL certificates fortrusted ones.

These issues are described in the following documents:

Official PostgreSQL annoucement at http://www.postgresql.org/about/news.1170

State: Resolved
First released: 24-Dec-2009
Sun Alert Link:http://sunsolve.sun.com/search/document.do?assetkey=1-66-274870-1

Original Source

Url : http://blogs.sun.com/security/entry/sun_alert_274870_security_vulnerabilities

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-310 Cryptographic Issues

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13000
 
Oval ID: oval:org.mitre.oval:def:13000
Title: DSA-1964-1 postgresql-7.4, postgresql-8.1, postgresql-8.3 -- several
Description: Several vulnerabilities have been discovered in PostgreSQL, a database server. The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that PostgreSQL did not properly verify the Common Name attribute in X.509 certificates, enabling attackers to bypass the TLS protection on client-server connections, by relying on a certificate from a trusted CA which contains an embedded NUL byte in the Common Name. Authenticated database users could elevate their privileges by creating specially-crafted index functions. The following table shows fixed source package versions for the respective distributions. oldstable/etch stable/lenny testing/unstable postgresql-7.4 1:7.4.27-0etch1 postgresql-8.1 8.1.19-0etch1 postgresql-8.3 8.3.9-0lenny1 8.3.9-1 postgresql-8.4 8.4.2-1 In addition to these security fixes, the updates contain reliability improvements and fix other defects. We recommend that you upgrade your PostgreSQL packages.
Family: unix Class: patch
Reference(s): DSA-1964-1
CVE-2009-4034
CVE-2009-4136
 Version: 7
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): postgresql-7.4
postgresql-8.1
postgresql-8.3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13259
 
Oval ID: oval:org.mitre.oval:def:13259
Title: USN-876-1 -- postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerabilities
Description: It was discovered that PostgreSQL did not properly handle certificates with NULL characters in the Common Name field of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. It was discovered that PostgreSQL did not properly manage session-local state. A remote authenticated user could exploit this to escalate priviliges within PostgreSQL
Family: unix Class: patch
Reference(s): USN-876-1
CVE-2009-4034
CVE-2009-4136
 Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 8.10
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
 Product(s): postgresql-8.1
postgresql-8.3
postgresql-8.4
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:6869
 
Oval ID: oval:org.mitre.oval:def:6869
Title: DSA-1964 postgresql-7.4, postgresql-8.1, postgresql-8.3 -- several vulnerabilities
Description: Several vulnerabilities have been discovered in PostgreSQL, a database server. The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that PostgreSQL did not properly verify the Common Name attribute in X.509 certificates, enabling attackers to bypass the TLS protection on client-server connections, by relying on a certificate from a trusted CA which contains an embedded NUL byte in the Common Name. Authenticated database users could elevate their privileges by creating specially-crafted index functions. The following matrix shows fixed source package versions for the respective distributions. In addition to these security fixes, the updates contain reliability improvements and fix other defects. We recommend that you upgrade your PostgreSQL packages.
Family: unix Class: patch
Reference(s): DSA-1964
CVE-2009-4034
CVE-2009-4136
 Version: 7
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): postgresql-7.4
postgresql-8.1
postgresql-8.3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9358
 
Oval ID: oval:org.mitre.oval:def:9358
Title: PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Description: PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Family: unix Class: vulnerability
Reference(s): CVE-2009-4136
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 92

OpenVAS Exploits

Date Description
2012-02-12 Name : Gentoo Security Advisory GLSA 201110-22 (postgresql-server postgresql-base)
File : nvt/glsa_201110_22.nasl
2011-08-09 Name : CentOS Update for postgresql CESA-2010:0429 centos5 i386
File : nvt/gb_CESA-2010_0429_postgresql_centos5_i386.nasl
2010-05-28 Name : CentOS Update for rh-postgresql CESA-2010:0427 centos3 i386
File : nvt/gb_CESA-2010_0427_rh-postgresql_centos3_i386.nasl
2010-05-28 Name : CentOS Update for postgresql CESA-2010:0428 centos4 i386
File : nvt/gb_CESA-2010_0428_postgresql_centos4_i386.nasl
2010-05-28 Name : RedHat Update for postgresql RHSA-2010:0427-01
File : nvt/gb_RHSA-2010_0427-01_postgresql.nasl
2010-05-28 Name : RedHat Update for postgresql RHSA-2010:0428-01
File : nvt/gb_RHSA-2010_0428-01_postgresql.nasl
2010-05-28 Name : RedHat Update for postgresql RHSA-2010:0429-01
File : nvt/gb_RHSA-2010_0429-01_postgresql.nasl
2010-01-15 Name : Ubuntu Update for PostgreSQL vulnerabilities USN-876-1
File : nvt/gb_ubuntu_USN_876_1.nasl
2009-12-30 Name : Fedora Core 11 FEDORA-2009-13363 (postgresql)
File : nvt/fcore_2009_13363.nasl
2009-12-30 Name : Fedora Core 12 FEDORA-2009-13381 (postgresql)
File : nvt/fcore_2009_13381.nasl
2009-12-30 Name : FreeBSD Ports: postgresql-client, postgresql-server
File : nvt/freebsd_postgresql-client.nasl
2009-12-16 Name : PostgreSQL NULL Character CA SSL Certificate Validation Security Bypass Vulne...
File : nvt/postgressql_37334.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
61039 PostgreSQL Index Function Session Manipulation Privilege Escalation
61038 PostgreSQL SSL Certificate Authority (CA) Null Byte Handling MiTM Weakness

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0427.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2012-12-28 Name : The remote database server is affected by multiple vulnerabilities.
File : postgresql_20091214.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100519_postgresql_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2011-10-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201110-22.nasl - Type : ACT_GATHER_INFO
2011-03-17 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_postgresql-100111.nasl - Type : ACT_GATHER_INFO
2010-10-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_postgresql-6768.nasl - Type : ACT_GATHER_INFO
2010-06-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2010-05-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2010-05-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0427.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0427.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1964.nasl - Type : ACT_GATHER_INFO
2010-01-19 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12571.nasl - Type : ACT_GATHER_INFO
2010-01-19 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_postgresql-100108.nasl - Type : ACT_GATHER_INFO
2010-01-19 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_postgresql-100108.nasl - Type : ACT_GATHER_INFO
2010-01-19 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_postgresql-100111.nasl - Type : ACT_GATHER_INFO
2010-01-19 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_postgresql-100108.nasl - Type : ACT_GATHER_INFO
2010-01-19 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_postgresql-6767.nasl - Type : ACT_GATHER_INFO
2010-01-04 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-876-1.nasl - Type : ACT_GATHER_INFO
2009-12-18 Name : The remote Fedora host is missing a security update.
File : fedora_2009-13381.nasl - Type : ACT_GATHER_INFO
2009-12-18 Name : The remote Fedora host is missing a security update.
File : fedora_2009-13363.nasl - Type : ACT_GATHER_INFO
2009-12-17 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_e7bc5600eaa011debd9c00215c6a37bb.nasl - Type : ACT_GATHER_INFO
2009-12-16 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-333.nasl - Type : ACT_GATHER_INFO