6.8 - USN-1378-1

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	PostgreSQL vulnerabilities

Informations
Name	USN-1378-1	First vendor Publication	2012-02-28
Vendor	Ubuntu	Last vendor Modification	2012-02-28
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS

Summary:

Several security issues were fixed in PostgreSQL.

Software Description: - postgresql-9.1: Object-relational SQL database - postgresql-8.4: Object-relational SQL database - postgresql-8.3: Object-relational SQL database

Details:

It was discovered that PostgreSQL incorrectly checked permissions on functions called by a trigger. An attacker could attach a trigger to a table they owned and possibly escalate privileges. (CVE-2012-0866)

It was discovered that PostgreSQL incorrectly truncated SSL certificate name checks to 32 characters. If a host name was exactly 32 characters, this issue could be exploited by an attacker to spoof the SSL certificate. This issue affected Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. (CVE-2012-0867)

It was discovered that the PostgreSQL pg_dump utility incorrectly filtered line breaks in object names. An attacker could create object names that execute arbitrary SQL commands when a dump script is reloaded. (CVE-2012-0868)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 11.10:
postgresql-9.1 9.1.3-0ubuntu0.11.10

Ubuntu 11.04:
postgresql-8.4 8.4.11-0ubuntu0.11.04

Ubuntu 10.10:
postgresql-8.4 8.4.11-0ubuntu0.10.10

Ubuntu 10.04 LTS:
postgresql-8.4 8.4.11-0ubuntu0.10.04

Ubuntu 8.04 LTS:
postgresql-8.3 8.3.18-0ubuntu0.8.04

In general, a standard system update will make all the necessary changes.

This update uses a new upstream release, which includes additional bug fixes.

References:
http://www.ubuntu.com/usn/usn-1378-1
CVE-2012-0866, CVE-2012-0867, CVE-2012-0868

Package Information:
https://launchpad.net/ubuntu/+source/postgresql-9.1/9.1.3-0ubuntu0.11.10
https://launchpad.net/ubuntu/+source/postgresql-8.4/8.4.11-0ubuntu0.11.04
https://launchpad.net/ubuntu/+source/postgresql-8.4/8.4.11-0ubuntu0.10.10
https://launchpad.net/ubuntu/+source/postgresql-8.4/8.4.11-0ubuntu0.10.04
https://launchpad.net/ubuntu/+source/postgresql-8.3/8.3.18-0ubuntu0.8.04

Original Source

Url : http://www.ubuntu.com/usn/USN-1378-1

CWE : Common Weakness Enumeration

%	Id	Name
25 %	CWE-295	Certificate Issues
25 %	CWE-264	Permissions, Privileges, and Access Controls
25 %	CWE-89	Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)
25 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15024

Oval ID:	oval:org.mitre.oval:def:15024
Title:	DSA-2418-1 postgresql-8.4 -- several
Description:	Several local vulnerabilities have been discovered in PostgreSQL, an object-relational SQL database. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2012-0866 It was discovered that the permissions of a function called by a trigger are not checked. This could result in privilege escalation. CVE-2012-0867 It was discovered that only the first 32 characters of a host name are checked when validating host names through SSL certificates. This could result in spoofing the connection in limited circumstances. CVE-2012-0868 It was discovered that pg_dump did not sanitise object names. This could result in arbitrary SQL command execution if a malformed dump file is opened.
Family:	unix	Class:	patch
Reference(s):	DSA-2418-1 CVE-2012-0866 CVE-2012-0867 CVE-2012-0868	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0	Product(s):	postgresql-8.4
Definition Synopsis:
Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND Installed architecture is all AND postgresql-8.4 DPKG is earlier than 8.4.11-0squeeze1

Definition Id: oval:org.mitre.oval:def:15167

Oval ID:	oval:org.mitre.oval:def:15167
Title:	USN-1378-1 -- PostgreSQL vulnerabilities
Description:	postgresql-9.1: Object-relational SQL database - postgresql-8.4: Object-relational SQL database - postgresql-8.3: Object-relational SQL database Several security issues were fixed in PostgreSQL.
Family:	unix	Class:	patch
Reference(s):	USN-1378-1 CVE-2012-0866 CVE-2012-0867 CVE-2012-0868	Version:	5
Platform(s):	Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10	Product(s):	PostgreSQL
Definition Synopsis:
Release section Ubuntu 11.04 is installed AND Installed architecture is all AND postgresql-8.4 DPKG is earlier than 8.4.11-0ubuntu0.11.04 OR Release section Ubuntu 11.10 is installed AND Installed architecture is all AND postgresql-9.1 DPKG is earlier than 9.1.3-0ubuntu0.11.10 OR Release section Ubuntu 8.04 is installed AND Installed architecture is all AND postgresql-8.3 DPKG is earlier than 8.3.18-0ubuntu0.8.04 OR Release section Ubuntu 10.04 is installed AND Installed architecture is all AND postgresql-8.4 DPKG is earlier than 8.4.11-0ubuntu0.10.04 OR Release section Ubuntu 10.10 is installed AND Installed architecture is all AND postgresql-8.4 DPKG is earlier than 8.4.11-0ubuntu0.10.10

Definition Id: oval:org.mitre.oval:def:21339

Oval ID:	oval:org.mitre.oval:def:21339
Title:	RHSA-2012:0678: postgresql and postgresql84 security update (Moderate)
Description:	CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Family:	unix	Class:	patch
Reference(s):	RHSA-2012:0678-01 CESA-2012:0678 CVE-2012-0866 CVE-2012-0867 CVE-2012-0868	Version:	42
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6	Product(s):	postgresql84 postgresql
Definition Synopsis:
Operation system section Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section postgresql84-pltcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-server is earlier than 0:8.4.11-1.el5_8 AND postgresql84-docs is earlier than 0:8.4.11-1.el5_8 AND postgresql84 is earlier than 0:8.4.11-1.el5_8 AND postgresql84-test is earlier than 0:8.4.11-1.el5_8 AND postgresql84-tcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-contrib is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plpython is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plperl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-python is earlier than 0:8.4.11-1.el5_8 AND postgresql84-devel is earlier than 0:8.4.11-1.el5_8 AND postgresql84-libs is earlier than 0:8.4.11-1.el5_8 AND Operation system section Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages section postgresql is earlier than 0:8.4.11-1.el6_2 AND postgresql-server is earlier than 0:8.4.11-1.el6_2 AND postgresql-libs is earlier than 0:8.4.11-1.el6_2 AND postgresql-devel is earlier than 0:8.4.11-1.el6_2 AND postgresql-pltcl is earlier than 0:8.4.11-1.el6_2 AND postgresql-plpython is earlier than 0:8.4.11-1.el6_2 AND postgresql-docs is earlier than 0:8.4.11-1.el6_2 AND postgresql-test is earlier than 0:8.4.11-1.el6_2 AND postgresql-plperl is earlier than 0:8.4.11-1.el6_2 AND postgresql-contrib is earlier than 0:8.4.11-1.el6_2

Definition Id: oval:org.mitre.oval:def:21471

Oval ID:	oval:org.mitre.oval:def:21471
Title:	RHSA-2012:0677: postgresql security update (Moderate)
Description:	CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Family:	unix	Class:	patch
Reference(s):	RHSA-2012:0677-00 CESA-2012:0677 CVE-2012-0866 CVE-2012-0868	Version:	29
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	postgresql
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section postgresql-libs is earlier than 0:8.1.23-4.el5_8 AND postgresql-pl is earlier than 0:8.1.23-4.el5_8 AND postgresql-python is earlier than 0:8.1.23-4.el5_8 AND postgresql-tcl is earlier than 0:8.1.23-4.el5_8 AND postgresql-docs is earlier than 0:8.1.23-4.el5_8 AND postgresql-devel is earlier than 0:8.1.23-4.el5_8 AND postgresql-test is earlier than 0:8.1.23-4.el5_8 AND postgresql-contrib is earlier than 0:8.1.23-4.el5_8 AND postgresql-server is earlier than 0:8.1.23-4.el5_8 AND postgresql is earlier than 0:8.1.23-4.el5_8

Definition Id: oval:org.mitre.oval:def:23252

Oval ID:	oval:org.mitre.oval:def:23252
Title:	DEPRECATED: ELSA-2012:0678: postgresql and postgresql84 security update (Moderate)
Description:	CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:0678-01 CVE-2012-0866 CVE-2012-0867 CVE-2012-0868	Version:	18
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	postgresql84 postgresql
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test postgresql84-pltcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-server is earlier than 0:8.4.11-1.el5_8 AND postgresql84-docs is earlier than 0:8.4.11-1.el5_8 AND postgresql84 is earlier than 0:8.4.11-1.el5_8 AND postgresql84-test is earlier than 0:8.4.11-1.el5_8 AND postgresql84-tcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-contrib is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plpython is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plperl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-python is earlier than 0:8.4.11-1.el5_8 AND postgresql84-devel is earlier than 0:8.4.11-1.el5_8 AND postgresql84-libs is earlier than 0:8.4.11-1.el5_8 OR rpm test Oracle Linux 6.x AND rpm test postgresql is earlier than 0:8.4.11-1.el6_2 AND postgresql-server is earlier than 0:8.4.11-1.el6_2 AND postgresql-libs is earlier than 0:8.4.11-1.el6_2 AND postgresql-devel is earlier than 0:8.4.11-1.el6_2 AND postgresql-pltcl is earlier than 0:8.4.11-1.el6_2 AND postgresql-plpython is earlier than 0:8.4.11-1.el6_2 AND postgresql-docs is earlier than 0:8.4.11-1.el6_2 AND postgresql-test is earlier than 0:8.4.11-1.el6_2 AND postgresql-plperl is earlier than 0:8.4.11-1.el6_2 AND postgresql-contrib is earlier than 0:8.4.11-1.el6_2

Definition Id: oval:org.mitre.oval:def:23418

Oval ID:	oval:org.mitre.oval:def:23418
Title:	ELSA-2012:0677: postgresql security update (Moderate)
Description:	CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:0677-00 CVE-2012-0866 CVE-2012-0868	Version:	13
Platform(s):	Oracle Linux 5	Product(s):	postgresql
Definition Synopsis:
Oracle Linux 5.x rpm test postgresql-libs is earlier than 0:8.1.23-4.el5_8 AND postgresql-pl is earlier than 0:8.1.23-4.el5_8 AND postgresql-python is earlier than 0:8.1.23-4.el5_8 AND postgresql-tcl is earlier than 0:8.1.23-4.el5_8 AND postgresql-docs is earlier than 0:8.1.23-4.el5_8 AND postgresql-devel is earlier than 0:8.1.23-4.el5_8 AND postgresql-test is earlier than 0:8.1.23-4.el5_8 AND postgresql-contrib is earlier than 0:8.1.23-4.el5_8 AND postgresql-server is earlier than 0:8.1.23-4.el5_8 AND postgresql is earlier than 0:8.1.23-4.el5_8

Definition Id: oval:org.mitre.oval:def:23770

Oval ID:	oval:org.mitre.oval:def:23770
Title:	ELSA-2012:0678: postgresql and postgresql84 security update (Moderate)
Description:	CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:0678-01 CVE-2012-0866 CVE-2012-0867 CVE-2012-0868	Version:	17
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	postgresql84 postgresql
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test postgresql84-pltcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-server is earlier than 0:8.4.11-1.el5_8 AND postgresql84-docs is earlier than 0:8.4.11-1.el5_8 AND postgresql84 is earlier than 0:8.4.11-1.el5_8 AND postgresql84-test is earlier than 0:8.4.11-1.el5_8 AND postgresql84-tcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-contrib is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plpython is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plperl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-python is earlier than 0:8.4.11-1.el5_8 AND postgresql84-devel is earlier than 0:8.4.11-1.el5_8 AND postgresql84-libs is earlier than 0:8.4.11-1.el5_8 OR rpm test Oracle Linux 6.x AND rpm test postgresql is earlier than 0:8.4.11-1.el6_2 AND postgresql-server is earlier than 0:8.4.11-1.el6_2 AND postgresql-libs is earlier than 0:8.4.11-1.el6_2 AND postgresql-devel is earlier than 0:8.4.11-1.el6_2 AND postgresql-pltcl is earlier than 0:8.4.11-1.el6_2 AND postgresql-plpython is earlier than 0:8.4.11-1.el6_2 AND postgresql-docs is earlier than 0:8.4.11-1.el6_2 AND postgresql-test is earlier than 0:8.4.11-1.el6_2 AND postgresql-plperl is earlier than 0:8.4.11-1.el6_2 AND postgresql-contrib is earlier than 0:8.4.11-1.el6_2

Definition Id: oval:org.mitre.oval:def:27807

Oval ID:	oval:org.mitre.oval:def:27807
Title:	DEPRECATED: ELSA-2012-0678 -- postgresql and postgresql84 security update (moderate)
Description:	[8.4.11-1] - Update to PostgreSQL 8.4.11, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/8.4/static/release-8-4-10.html including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868 Resolves: #812081
Family:	unix	Class:	patch
Reference(s):	ELSA-2012-0678 CVE-2012-0867 CVE-2012-0866 CVE-2012-0868	Version:	4
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	postgresql84 postgresql
Definition Synopsis:
Oracle Linux 5 release section Oracle Linux 5.x Packages match section postgresql84 is earlier than 0:8.4.11-1.el5_8 AND postgresql84-contrib is earlier than 0:8.4.11-1.el5_8 AND postgresql84-devel is earlier than 0:8.4.11-1.el5_8 AND postgresql84-docs is earlier than 0:8.4.11-1.el5_8 AND postgresql84-libs is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plperl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-plpython is earlier than 0:8.4.11-1.el5_8 AND postgresql84-pltcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-python is earlier than 0:8.4.11-1.el5_8 AND postgresql84-server is earlier than 0:8.4.11-1.el5_8 AND postgresql84-tcl is earlier than 0:8.4.11-1.el5_8 AND postgresql84-test is earlier than 0:8.4.11-1.el5_8 AND Oracle Linux 6 release section Oracle Linux 6.x Packages match section postgresql is earlier than 0:8.4.11-1.el6_2 AND postgresql-contrib is earlier than 0:8.4.11-1.el6_2 AND postgresql-devel is earlier than 0:8.4.11-1.el6_2 AND postgresql-docs is earlier than 0:8.4.11-1.el6_2 AND postgresql-libs is earlier than 0:8.4.11-1.el6_2 AND postgresql-plperl is earlier than 0:8.4.11-1.el6_2 AND postgresql-plpython is earlier than 0:8.4.11-1.el6_2 AND postgresql-pltcl is earlier than 0:8.4.11-1.el6_2 AND postgresql-server is earlier than 0:8.4.11-1.el6_2 AND postgresql-test is earlier than 0:8.4.11-1.el6_2

Definition Id: oval:org.mitre.oval:def:27850

Oval ID:	oval:org.mitre.oval:def:27850
Title:	DEPRECATED: ELSA-2012-0677 -- postgresql security update (moderate)
Description:	[8.1.23-4] - Back-port upstream fixes for CVE-2012-0866 and CVE-2012-0868 Resolves: #812070 [8.1.23-3] - Back-port upstream fix for unregistering OpenSSL callbacks at close Resolves: #728828 [8.1.23-2] - Back-port upstream fix for CVE-2011-2483 Resolves: #740738
Family:	unix	Class:	patch
Reference(s):	ELSA-2012-0677 CVE-2012-0866 CVE-2012-0868	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	postgresql
Definition Synopsis:
Oracle Linux 5.x Packages match section postgresql is earlier than 0:8.1.23-4.el5_8 AND postgresql-contrib is earlier than 0:8.1.23-4.el5_8 AND postgresql-devel is earlier than 0:8.1.23-4.el5_8 AND postgresql-docs is earlier than 0:8.1.23-4.el5_8 AND postgresql-libs is earlier than 0:8.1.23-4.el5_8 AND postgresql-pl is earlier than 0:8.1.23-4.el5_8 AND postgresql-python is earlier than 0:8.1.23-4.el5_8 AND postgresql-server is earlier than 0:8.1.23-4.el5_8 AND postgresql-tcl is earlier than 0:8.1.23-4.el5_8 AND postgresql-test is earlier than 0:8.1.23-4.el5_8

CPE : Common Platform Enumeration

Type	Description	Count
Application	Postgresql cpe:2.3:a:postgresql:postgresql:9.1.2:::::::* cpe:2.3:a:postgresql:postgresql:9.1.1:::::::* cpe:2.3:a:postgresql:postgresql:9.1:::::::* cpe:2.3:a:postgresql:postgresql:9.0.6:::::::* cpe:2.3:a:postgresql:postgresql:9.0.5:::::::* cpe:2.3:a:postgresql:postgresql:9.0.4:::::::* cpe:2.3:a:postgresql:postgresql:9.0.3:::::::* cpe:2.3:a:postgresql:postgresql:9.0.2:::::::* cpe:2.3:a:postgresql:postgresql:9.0.1:::::::* cpe:2.3:a:postgresql:postgresql:9.0:::::::* cpe:2.3:a:postgresql:postgresql:8.4.9:::::::* cpe:2.3:a:postgresql:postgresql:8.4.8:::::::* cpe:2.3:a:postgresql:postgresql:8.4.7:::::::* cpe:2.3:a:postgresql:postgresql:8.4.6:::::::* cpe:2.3:a:postgresql:postgresql:8.4.5:::::::* cpe:2.3:a:postgresql:postgresql:8.4.4:::::::* cpe:2.3:a:postgresql:postgresql:8.4.3:::::::* cpe:2.3:a:postgresql:postgresql:8.4.2:::::::* cpe:2.3:a:postgresql:postgresql:8.4.10:::::::* cpe:2.3:a:postgresql:postgresql:8.4.1:::::::* cpe:2.3:a:postgresql:postgresql:8.4:::::::* cpe:2.3:a:postgresql:postgresql:8.3.9:::::::* cpe:2.3:a:postgresql:postgresql:8.3.8:::::::* cpe:2.3:a:postgresql:postgresql:8.3.7:::::::* cpe:2.3:a:postgresql:postgresql:8.3.6:::::::* cpe:2.3:a:postgresql:postgresql:8.3.5:::::::* cpe:2.3:a:postgresql:postgresql:8.3.4:::::::* cpe:2.3:a:postgresql:postgresql:8.3.3:::::::* cpe:2.3:a:postgresql:postgresql:8.3.2:::::::* cpe:2.3:a:postgresql:postgresql:8.3.17:::::::* cpe:2.3:a:postgresql:postgresql:8.3.16:::::::* cpe:2.3:a:postgresql:postgresql:8.3.15:::::::* cpe:2.3:a:postgresql:postgresql:8.3.14:::::::* cpe:2.3:a:postgresql:postgresql:8.3.13:::::::* cpe:2.3:a:postgresql:postgresql:8.3.12:::::::* cpe:2.3:a:postgresql:postgresql:8.3.11:::::::* cpe:2.3:a:postgresql:postgresql:8.3.10:::::::* cpe:2.3:a:postgresql:postgresql:8.3.1:::::::* cpe:2.3:a:postgresql:postgresql:8.3:::::::*	39
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:6.0:::::::*	1
Os	Opensuse Project Opensuse cpe:2.3:o:opensuse_project:opensuse:12.2:::::::*	1
Os	Redhat Desktop Workstation cpe:2.3:o:redhat:desktop_workstation:5:::::::*	1
Os	Redhat Enterprise Linux cpe:2.3:o:redhat:enterprise_linux:5.0:::::::*	1
Os	Redhat Enterprise Linux Desktop cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::* cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*	2
Os	Redhat Enterprise Linux Hpc Node cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:::::::*	1
Os	Redhat Enterprise Linux Server cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*	1
Os	Redhat Enterprise Linux Server Aus cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:::::::*	1
Os	Redhat Enterprise Linux Server Eus cpe:2.3:o:redhat:enterprise_linux_server_eus:6.2.z:::::::*	1
Os	Redhat Enterprise Linux Workstation cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*	1

OpenVAS Exploits

Date	Description
2012-10-03	Name : Gentoo Security Advisory GLSA 201209-24 (PostgreSQL) File : nvt/glsa_201209_24.nasl
2012-08-30	Name : Fedora Update for postgresql FEDORA-2012-2508 File : nvt/gb_fedora_2012_2508_postgresql_fc17.nasl
2012-08-30	Name : Fedora Update for postgresql FEDORA-2012-12156 File : nvt/gb_fedora_2012_12156_postgresql_fc16.nasl
2012-07-30	Name : CentOS Update for postgresql84 CESA-2012:0678 centos5 File : nvt/gb_CESA-2012_0678_postgresql84_centos5.nasl
2012-07-30	Name : CentOS Update for postgresql CESA-2012:0678 centos6 File : nvt/gb_CESA-2012_0678_postgresql_centos6.nasl
2012-07-30	Name : CentOS Update for postgresql CESA-2012:0677 centos5 File : nvt/gb_CESA-2012_0677_postgresql_centos5.nasl
2012-06-19	Name : Fedora Update for postgresql FEDORA-2012-8893 File : nvt/gb_fedora_2012_8893_postgresql_fc16.nasl
2012-06-19	Name : Fedora Update for postgresql FEDORA-2012-8915 File : nvt/gb_fedora_2012_8915_postgresql_fc15.nasl
2012-05-22	Name : RedHat Update for postgresql RHSA-2012:0677-01 File : nvt/gb_RHSA-2012_0677-01_postgresql.nasl
2012-05-22	Name : RedHat Update for postgresql and postgresql84 RHSA-2012:0678-01 File : nvt/gb_RHSA-2012_0678-01_postgresql_and_postgresql84.nasl
2012-04-02	Name : Fedora Update for postgresql FEDORA-2012-2591 File : nvt/gb_fedora_2012_2591_postgresql_fc16.nasl
2012-03-12	Name : Debian Security Advisory DSA 2418-1 (postgresql-8.4) File : nvt/deb_2418_1.nasl
2012-03-12	Name : FreeBSD Ports: postgresql-client File : nvt/freebsd_postgresql-client0.nasl
2012-03-09	Name : Fedora Update for postgresql FEDORA-2012-2589 File : nvt/gb_fedora_2012_2589_postgresql_fc15.nasl
2012-03-07	Name : Mandriva Update for postgresql MDVSA-2012:026 (postgresql) File : nvt/gb_mandriva_MDVSA_2012_026.nasl
2012-03-07	Name : Mandriva Update for postgresql8.3 MDVSA-2012:027 (postgresql8.3) File : nvt/gb_mandriva_MDVSA_2012_027.nasl
2012-03-07	Name : Ubuntu Update for postgresql-9.1 USN-1378-1 File : nvt/gb_ubuntu_USN_1378_1.nasl

Nessus® Vulnerability Scanner

Date	Description
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-603.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-214.nasl - Type : ACT_GATHER_INFO
2013-09-04	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-82.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0678.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0677.nasl - Type : ACT_GATHER_INFO
2013-01-25	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_postgresql-120322.nasl - Type : ACT_GATHER_INFO
2012-12-28	Name : The remote database server is affected by multiple vulnerabilities. File : postgresql_20120227.nasl - Type : ACT_GATHER_INFO
2012-12-28	Name : The remote database server is affected by multiple vulnerabilities. File : postgresql_8318.nasl - Type : ACT_GATHER_INFO
2012-09-29	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-24.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120521_postgresql_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120521_postgresql_and_postgresql84_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-06-15	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-092.nasl - Type : ACT_GATHER_INFO
2012-06-06	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_postgresql-8071.nasl - Type : ACT_GATHER_INFO
2012-05-22	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0677.nasl - Type : ACT_GATHER_INFO
2012-05-22	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0678.nasl - Type : ACT_GATHER_INFO
2012-05-22	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0678.nasl - Type : ACT_GATHER_INFO
2012-05-22	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0677.nasl - Type : ACT_GATHER_INFO
2012-03-08	Name : The remote Fedora host is missing a security update. File : fedora_2012-2591.nasl - Type : ACT_GATHER_INFO
2012-03-08	Name : The remote Fedora host is missing a security update. File : fedora_2012-2589.nasl - Type : ACT_GATHER_INFO
2012-03-07	Name : The remote Fedora host is missing a security update. File : fedora_2012-2508.nasl - Type : ACT_GATHER_INFO
2012-03-01	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-026.nasl - Type : ACT_GATHER_INFO
2012-02-29	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_174b8864623711e1be1814dae938ec40.nasl - Type : ACT_GATHER_INFO
2012-02-29	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1378-1.nasl - Type : ACT_GATHER_INFO
2012-02-28	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2418.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:59:46	Multiple Updates
2013-01-04 13:21:08	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	4
Oval ID(s)	9
CPE ID(s)	50
Openvas Exploit(s)	17
Nessus® Exploit(s)	24

	Related
6.8	CVE-2012-0868
6.5	CVE-2012-0866
4.3	CVE-2012-0867
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)