Executive Summary
| Summary | |
|---|---|
| Title | PostgreSQL vulnerability |
| Informations | |||
|---|---|---|---|
| Name | USN-258-1 | First vendor Publication | 2006-02-27 |
| Vendor | Ubuntu | Last vendor Modification | 2006-02-27 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:S/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 1.5 | Attack Range | Local |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 2.7 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) Ubuntu 5.10 (Breezy Badger) The following packages are affected: postgresql postgresql-7.4 postgresql-8.0 The problem can be corrected by upgrading the affected package to version 7.4.5-3ubuntu0.6 (for Ubuntu 4.10), 7.4.7-2ubuntu2.2 (for Ubuntu 5.04), 8.0.3-15ubuntu2.1 (postgresql-8.0 for Ubuntu 5.10), or 1:7.4.8-17ubuntu1.1 (postgresql-7.4 for Ubuntu 5.10). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Akio Ishida discovered that the SET SESSION AUTHORIZATION command did not properly verify the validity of its argument. An authenticated PostgreSQL user could exploit this to crash the server. However, this does not affect the official binary Ubuntu packages. The crash can only be triggered if the source package is rebuilt with assertions enabled (which is not the case in the official binary packages). |
Original Source
| Url : http://www.ubuntu.com/usn/USN-258-1 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-04 | Name : FreeBSD Ports: postgresql-server File : nvt/freebsd_postgresql-server.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 23224 | PostgreSQL SET SESSION AUTHORIZATION Assert Failure DoS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-03-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-258-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:19 |
|
