6.5 - CVE-2009-4136

Executive Summary

Informations
Name	CVE-2009-4136	First vendor Publication	2009-12-15
Vendor	Cve	Last vendor Modification	2018-10-10

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Cvss Base Score	6.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4136

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13000

Oval ID:	oval:org.mitre.oval:def:13000
Title:	DSA-1964-1 postgresql-7.4, postgresql-8.1, postgresql-8.3 -- several
Description:	Several vulnerabilities have been discovered in PostgreSQL, a database server. The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that PostgreSQL did not properly verify the Common Name attribute in X.509 certificates, enabling attackers to bypass the TLS protection on client-server connections, by relying on a certificate from a trusted CA which contains an embedded NUL byte in the Common Name. Authenticated database users could elevate their privileges by creating specially-crafted index functions. The following table shows fixed source package versions for the respective distributions. oldstable/etch stable/lenny testing/unstable postgresql-7.4 1:7.4.27-0etch1 postgresql-8.1 8.1.19-0etch1 postgresql-8.3 8.3.9-0lenny1 8.3.9-1 postgresql-8.4 8.4.2-1 In addition to these security fixes, the updates contain reliability improvements and fix other defects. We recommend that you upgrade your PostgreSQL packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1964-1 CVE-2009-4034 CVE-2009-4136	Version:	7
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	postgresql-7.4 postgresql-8.1 postgresql-8.3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section postgresql-doc-8.3 DPKG is earlier than 8.3.9-0lenny1 AND postgresql-doc DPKG is earlier than 8.3.9-0lenny1 AND postgresql-client DPKG is earlier than 8.3.9-0lenny1 AND postgresql DPKG is earlier than 8.3.9-0lenny1 AND postgresql-contrib DPKG is earlier than 8.3.9-0lenny1 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section postgresql-client-8.3 DPKG is earlier than 8.3.9-0lenny1 AND postgresql-plperl-8.3 DPKG is earlier than 8.3.9-0lenny1 AND postgresql-8.3 DPKG is earlier than 8.3.9-0lenny1 AND libecpg6 DPKG is earlier than 8.3.9-0lenny1 AND libpq-dev DPKG is earlier than 8.3.9-0lenny1 AND postgresql-plpython-8.3 DPKG is earlier than 8.3.9-0lenny1 AND postgresql-contrib-8.3 DPKG is earlier than 8.3.9-0lenny1 AND postgresql-server-dev-8.3 DPKG is earlier than 8.3.9-0lenny1 AND libecpg-dev DPKG is earlier than 8.3.9-0lenny1 AND postgresql-pltcl-8.3 DPKG is earlier than 8.3.9-0lenny1 AND libpq5 DPKG is earlier than 8.3.9-0lenny1 AND libpgtypes3 DPKG is earlier than 8.3.9-0lenny1 AND libecpg-compat3 DPKG is earlier than 8.3.9-0lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section postgresql-doc-8.1 DPKG is earlier than 8.1.19-0etch1 AND postgresql-server-dev-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND postgresql-doc-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND postgresql-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND postgresql-client-8.1 DPKG is earlier than 8.1.19-0etch1 AND postgresql-8.1 DPKG is earlier than 8.1.19-0etch1 AND libpq-dev DPKG is earlier than 8.1.19-0etch1 AND postgresql-plpython-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND postgresql-contrib-8.1 DPKG is earlier than 8.1.19-0etch1 AND postgresql-contrib-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND libecpg5 DPKG is earlier than 8.1.19-0etch1 AND postgresql-pltcl-8.1 DPKG is earlier than 8.1.19-0etch1 AND postgresql-client-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND libpgtypes2 DPKG is earlier than 8.1.19-0etch1 AND postgresql-server-dev-8.1 DPKG is earlier than 8.1.19-0etch1 AND libecpg-dev DPKG is earlier than 8.1.19-0etch1 AND postgresql-plpython-8.1 DPKG is earlier than 8.1.19-0etch1 AND libpq4 DPKG is earlier than 8.1.19-0etch1 AND postgresql-plperl-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND postgresql-plperl-8.1 DPKG is earlier than 8.1.19-0etch1 AND postgresql-pltcl-7.4 DPKG is earlier than 1:7.4.27-0etch1 AND libecpg-compat2 DPKG is earlier than 8.1.19-0etch1

Definition Id: oval:org.mitre.oval:def:13259

Oval ID:	oval:org.mitre.oval:def:13259
Title:	USN-876-1 -- postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerabilities
Description:	It was discovered that PostgreSQL did not properly handle certificates with NULL characters in the Common Name field of X.509 certificates. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. It was discovered that PostgreSQL did not properly manage session-local state. A remote authenticated user could exploit this to escalate priviliges within PostgreSQL
Family:	unix	Class:	patch
Reference(s):	USN-876-1 CVE-2009-4034 CVE-2009-4136	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 8.10 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 9.04	Product(s):	postgresql-8.1 postgresql-8.3 postgresql-8.4
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section postgresql-doc-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-doc DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-client DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-contrib DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql DPKG is earlier than 8.3.9-0ubuntu8.04 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section postgresql-client-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND libecpg6 DPKG is earlier than 8.3.9-0ubuntu8.04 AND libpq-dev DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-plpython-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-contrib-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-server-dev-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND libpgtypes3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND libecpg-dev DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-pltcl-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND libpq5 DPKG is earlier than 8.3.9-0ubuntu8.04 AND postgresql-plperl-8.3 DPKG is earlier than 8.3.9-0ubuntu8.04 AND libecpg-compat3 DPKG is earlier than 8.3.9-0ubuntu8.04 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section postgresql-doc-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-doc DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-client DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-contrib DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql DPKG is earlier than 8.3.9-0ubuntu8.10 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section postgresql-client-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND libecpg6 DPKG is earlier than 8.3.9-0ubuntu8.10 AND libpq-dev DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-plpython-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-contrib-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-server-dev-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND libpgtypes3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND libecpg-dev DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-pltcl-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND libpq5 DPKG is earlier than 8.3.9-0ubuntu8.10 AND postgresql-plperl-8.3 DPKG is earlier than 8.3.9-0ubuntu8.10 AND libecpg-compat3 DPKG is earlier than 8.3.9-0ubuntu8.10 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section postgresql-doc-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-client DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-contrib DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-doc DPKG is earlier than 8.4.2-0ubuntu9.10 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section postgresql-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-contrib-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-client-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND libecpg6 DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-pltcl-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-plpython-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND libpq-dev DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-server-dev-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND libecpg-dev DPKG is earlier than 8.4.2-0ubuntu9.10 AND libpq5 DPKG is earlier than 8.4.2-0ubuntu9.10 AND libpgtypes3 DPKG is earlier than 8.4.2-0ubuntu9.10 AND postgresql-plperl-8.4 DPKG is earlier than 8.4.2-0ubuntu9.10 AND libecpg-compat3 DPKG is earlier than 8.4.2-0ubuntu9.10 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independet section Installed architecture is all AND postgresql-doc-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section postgresql-client-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND postgresql-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND postgresql-contrib-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND libecpg5 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND postgresql-pltcl-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND postgresql-server-dev-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND libpgtypes2 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND libecpg-dev DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND postgresql-plpython-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND libpq4 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND libpq-dev DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND postgresql-plperl-8.1 DPKG is earlier than 8.1.19-0ubuntu0.6.06 AND libecpg-compat2 DPKG is earlier than 8.1.19-0ubuntu0.6.06 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section postgresql-doc-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-doc DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-client DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-contrib DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql DPKG is earlier than 8.3.9-0ubuntu9.04 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section postgresql-client-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-plperl-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND libecpg6 DPKG is earlier than 8.3.9-0ubuntu9.04 AND libpq-dev DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-plpython-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-contrib-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-server-dev-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND libecpg-dev DPKG is earlier than 8.3.9-0ubuntu9.04 AND postgresql-pltcl-8.3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND libpq5 DPKG is earlier than 8.3.9-0ubuntu9.04 AND libpgtypes3 DPKG is earlier than 8.3.9-0ubuntu9.04 AND libecpg-compat3 DPKG is earlier than 8.3.9-0ubuntu9.04

Definition Id: oval:org.mitre.oval:def:6869

Oval ID:	oval:org.mitre.oval:def:6869
Title:	DSA-1964 postgresql-7.4, postgresql-8.1, postgresql-8.3 -- several vulnerabilities
Description:	Several vulnerabilities have been discovered in PostgreSQL, a database server. The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that PostgreSQL did not properly verify the Common Name attribute in X.509 certificates, enabling attackers to bypass the TLS protection on client-server connections, by relying on a certificate from a trusted CA which contains an embedded NUL byte in the Common Name. Authenticated database users could elevate their privileges by creating specially-crafted index functions. The following matrix shows fixed source package versions for the respective distributions. In addition to these security fixes, the updates contain reliability improvements and fix other defects. We recommend that you upgrade your PostgreSQL packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1964 CVE-2009-4034 CVE-2009-4136	Version:	7
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	postgresql-7.4 postgresql-8.1 postgresql-8.3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section postgresql-doc-8.3 is earlier than 8.3.9-0lenny1 AND postgresql-doc is earlier than 8.3.9-0lenny1 AND postgresql-client is earlier than 8.3.9-0lenny1 AND postgresql is earlier than 8.3.9-0lenny1 AND postgresql-contrib is earlier than 8.3.9-0lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section postgresql-client-8.3 is earlier than 8.3.9-0lenny1 AND postgresql-plperl-8.3 is earlier than 8.3.9-0lenny1 AND postgresql-8.3 is earlier than 8.3.9-0lenny1 AND libecpg6 is earlier than 8.3.9-0lenny1 AND libpq-dev is earlier than 8.3.9-0lenny1 AND postgresql-plpython-8.3 is earlier than 8.3.9-0lenny1 AND postgresql-contrib-8.3 is earlier than 8.3.9-0lenny1 AND postgresql-server-dev-8.3 is earlier than 8.3.9-0lenny1 AND libecpg-dev is earlier than 8.3.9-0lenny1 AND postgresql-pltcl-8.3 is earlier than 8.3.9-0lenny1 AND libpq5 is earlier than 8.3.9-0lenny1 AND libpgtypes3 is earlier than 8.3.9-0lenny1 AND libecpg-compat3 is earlier than 8.3.9-0lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section postgresql-doc-8.1 is earlier than 8.1.19-0etch1 AND postgresql-server-dev-7.4 is earlier than 1:7.4.27-0etch1 AND postgresql-doc-7.4 is earlier than 1:7.4.27-0etch1 AND postgresql-7.4 is earlier than 1:7.4.27-0etch1 AND postgresql-client-8.1 is earlier than 8.1.19-0etch1 AND postgresql-8.1 is earlier than 8.1.19-0etch1 AND libpq-dev is earlier than 8.1.19-0etch1 AND postgresql-plpython-7.4 is earlier than 1:7.4.27-0etch1 AND postgresql-contrib-8.1 is earlier than 8.1.19-0etch1 AND postgresql-contrib-7.4 is earlier than 1:7.4.27-0etch1 AND libecpg5 is earlier than 8.1.19-0etch1 AND postgresql-pltcl-8.1 is earlier than 8.1.19-0etch1 AND postgresql-client-7.4 is earlier than 1:7.4.27-0etch1 AND libpgtypes2 is earlier than 8.1.19-0etch1 AND postgresql-server-dev-8.1 is earlier than 8.1.19-0etch1 AND libecpg-dev is earlier than 8.1.19-0etch1 AND postgresql-plpython-8.1 is earlier than 8.1.19-0etch1 AND libpq4 is earlier than 8.1.19-0etch1 AND postgresql-plperl-7.4 is earlier than 1:7.4.27-0etch1 AND postgresql-plperl-8.1 is earlier than 8.1.19-0etch1 AND postgresql-pltcl-7.4 is earlier than 1:7.4.27-0etch1 AND libecpg-compat2 is earlier than 8.1.19-0etch1

Definition Id: oval:org.mitre.oval:def:9358

Oval ID:	oval:org.mitre.oval:def:9358
Title:	PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Description:	PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-4136	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section rh-postgresql-devel is earlier than 0:7.3.21-3 AND rh-postgresql-server is earlier than 0:7.3.21-3 AND rh-postgresql-python is earlier than 0:7.3.21-3 AND rh-postgresql-libs is earlier than 0:7.3.21-3 AND rh-postgresql-docs is earlier than 0:7.3.21-3 AND rh-postgresql-test is earlier than 0:7.3.21-3 AND rh-postgresql-pl is earlier than 0:7.3.21-3 AND rh-postgresql-tcl is earlier than 0:7.3.21-3 AND rh-postgresql is earlier than 0:7.3.21-3 AND rh-postgresql-contrib is earlier than 0:7.3.21-3 AND rh-postgresql-jdbc is earlier than 0:7.3.21-3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section postgresql is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-docs is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-pl is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-tcl is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-libs is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-contrib is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-python is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-test is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-jdbc is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-server is earlier than 0:7.4.29-1.el4_8.1 AND postgresql-devel is earlier than 0:7.4.29-1.el4_8.1 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section postgresql is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-docs is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-pl is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-tcl is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-libs is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-contrib is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-python is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-test is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-server is earlier than 0:8.1.21-1.el5_5.1 AND postgresql-devel is earlier than 0:8.1.21-1.el5_5.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Postgresql cpe:2.3:a:postgresql:postgresql:8.4.1:::::::* cpe:2.3:a:postgresql:postgresql:8.3.8:::::::* cpe:2.3:a:postgresql:postgresql:8.3.7:::::::* cpe:2.3:a:postgresql:postgresql:8.3.6:::::::* cpe:2.3:a:postgresql:postgresql:8.3.5:::::::* cpe:2.3:a:postgresql:postgresql:8.3.4:::::::* cpe:2.3:a:postgresql:postgresql:8.3.3:::::::* cpe:2.3:a:postgresql:postgresql:8.3.2:::::::* cpe:2.3:a:postgresql:postgresql:8.3.1:::::::* cpe:2.3:a:postgresql:postgresql:8.2.9:::::::* cpe:2.3:a:postgresql:postgresql:8.2.8:::::::* cpe:2.3:a:postgresql:postgresql:8.2.7:::::::* cpe:2.3:a:postgresql:postgresql:8.2.6:::::::* cpe:2.3:a:postgresql:postgresql:8.2.5:::::::* cpe:2.3:a:postgresql:postgresql:8.2.4:::::::* cpe:2.3:a:postgresql:postgresql:8.2.3:::::::* cpe:2.3:a:postgresql:postgresql:8.2.2:::::::* cpe:2.3:a:postgresql:postgresql:8.2.14:::::::* cpe:2.3:a:postgresql:postgresql:8.2.13:::::::* cpe:2.3:a:postgresql:postgresql:8.2.12:::::::* cpe:2.3:a:postgresql:postgresql:8.2.11:::::::* cpe:2.3:a:postgresql:postgresql:8.2.10:::::::* cpe:2.3:a:postgresql:postgresql:8.2.1:::::::* cpe:2.3:a:postgresql:postgresql:8.2:::::::* cpe:2.3:a:postgresql:postgresql:8.1.9:::::::* cpe:2.3:a:postgresql:postgresql:8.1.8:::::::* cpe:2.3:a:postgresql:postgresql:8.1.7:::::::* cpe:2.3:a:postgresql:postgresql:8.1.6:::::::* cpe:2.3:a:postgresql:postgresql:8.1.5:::::::* cpe:2.3:a:postgresql:postgresql:8.1.4:::::::* cpe:2.3:a:postgresql:postgresql:8.1.3:::::::* cpe:2.3:a:postgresql:postgresql:8.1.2:::::::* cpe:2.3:a:postgresql:postgresql:8.1.18:::::::* cpe:2.3:a:postgresql:postgresql:8.1.17:::::::* cpe:2.3:a:postgresql:postgresql:8.1.16:::::::* cpe:2.3:a:postgresql:postgresql:8.1.15:::::::* cpe:2.3:a:postgresql:postgresql:8.1.14:::::::* cpe:2.3:a:postgresql:postgresql:8.1.13:::::::* cpe:2.3:a:postgresql:postgresql:8.1.12:::::::* cpe:2.3:a:postgresql:postgresql:8.1.11:::::::* cpe:2.3:a:postgresql:postgresql:8.1.10:::::::* cpe:2.3:a:postgresql:postgresql:8.1.1:::::::* cpe:2.3:a:postgresql:postgresql:8.1.0:::::::* cpe:2.3:a:postgresql:postgresql:8.0.9:::::::* cpe:2.3:a:postgresql:postgresql:8.0.8:::::::* cpe:2.3:a:postgresql:postgresql:8.0.7:::::::* cpe:2.3:a:postgresql:postgresql:8.0.6:::::::* cpe:2.3:a:postgresql:postgresql:8.0.5:::::::* cpe:2.3:a:postgresql:postgresql:8.0.4:::::::* cpe:2.3:a:postgresql:postgresql:8.0.3:::::::* cpe:2.3:a:postgresql:postgresql:8.0.22:::::::* cpe:2.3:a:postgresql:postgresql:8.0.21:::::::* cpe:2.3:a:postgresql:postgresql:8.0.20:::::::* cpe:2.3:a:postgresql:postgresql:8.0.2:::::::* cpe:2.3:a:postgresql:postgresql:8.0.19:::::::* cpe:2.3:a:postgresql:postgresql:8.0.18:::::::* cpe:2.3:a:postgresql:postgresql:8.0.17:::::::* cpe:2.3:a:postgresql:postgresql:8.0.16:::::::* cpe:2.3:a:postgresql:postgresql:8.0.15:::::::* cpe:2.3:a:postgresql:postgresql:8.0.14:::::::* cpe:2.3:a:postgresql:postgresql:8.0.13:::::::* cpe:2.3:a:postgresql:postgresql:8.0.12:::::::* cpe:2.3:a:postgresql:postgresql:8.0.11:::::::* cpe:2.3:a:postgresql:postgresql:8.0.10:::::::* cpe:2.3:a:postgresql:postgresql:8.0.1:::::::* cpe:2.3:a:postgresql:postgresql:8.0.0:::::::* cpe:2.3:a:postgresql:postgresql:7.4.9:::::::* cpe:2.3:a:postgresql:postgresql:7.4.8:::::::* cpe:2.3:a:postgresql:postgresql:7.4.7:::::::* cpe:2.3:a:postgresql:postgresql:7.4.6:::::::* cpe:2.3:a:postgresql:postgresql:7.4.5:::::::* cpe:2.3:a:postgresql:postgresql:7.4.4:::::::* cpe:2.3:a:postgresql:postgresql:7.4.3:::::::* cpe:2.3:a:postgresql:postgresql:7.4.26:::::::* cpe:2.3:a:postgresql:postgresql:7.4.25:::::::* cpe:2.3:a:postgresql:postgresql:7.4.24:::::::* cpe:2.3:a:postgresql:postgresql:7.4.23:::::::* cpe:2.3:a:postgresql:postgresql:7.4.22:::::::* cpe:2.3:a:postgresql:postgresql:7.4.21:::::::* cpe:2.3:a:postgresql:postgresql:7.4.20:::::::* cpe:2.3:a:postgresql:postgresql:7.4.2:::::::* cpe:2.3:a:postgresql:postgresql:7.4.19:::::::* cpe:2.3:a:postgresql:postgresql:7.4.18:::::::* cpe:2.3:a:postgresql:postgresql:7.4.17:::::::* cpe:2.3:a:postgresql:postgresql:7.4.16:::::::* cpe:2.3:a:postgresql:postgresql:7.4.15:::::::* cpe:2.3:a:postgresql:postgresql:7.4.14:::::::* cpe:2.3:a:postgresql:postgresql:7.4.13:::::::* cpe:2.3:a:postgresql:postgresql:7.4.12:::::::* cpe:2.3:a:postgresql:postgresql:7.4.11:::::::* cpe:2.3:a:postgresql:postgresql:7.4.10:::::::* cpe:2.3:a:postgresql:postgresql:7.4.1:::::::*	92

OpenVAS Exploits

Date	Description
2012-02-12	Name : Gentoo Security Advisory GLSA 201110-22 (postgresql-server postgresql-base) File : nvt/glsa_201110_22.nasl
2011-08-09	Name : CentOS Update for postgresql CESA-2010:0429 centos5 i386 File : nvt/gb_CESA-2010_0429_postgresql_centos5_i386.nasl
2010-05-28	Name : CentOS Update for rh-postgresql CESA-2010:0427 centos3 i386 File : nvt/gb_CESA-2010_0427_rh-postgresql_centos3_i386.nasl
2010-05-28	Name : CentOS Update for postgresql CESA-2010:0428 centos4 i386 File : nvt/gb_CESA-2010_0428_postgresql_centos4_i386.nasl
2010-05-28	Name : RedHat Update for postgresql RHSA-2010:0427-01 File : nvt/gb_RHSA-2010_0427-01_postgresql.nasl
2010-05-28	Name : RedHat Update for postgresql RHSA-2010:0428-01 File : nvt/gb_RHSA-2010_0428-01_postgresql.nasl
2010-05-28	Name : RedHat Update for postgresql RHSA-2010:0429-01 File : nvt/gb_RHSA-2010_0429-01_postgresql.nasl
2010-01-15	Name : Ubuntu Update for PostgreSQL vulnerabilities USN-876-1 File : nvt/gb_ubuntu_USN_876_1.nasl
2009-12-30	Name : Fedora Core 11 FEDORA-2009-13363 (postgresql) File : nvt/fcore_2009_13363.nasl
2009-12-30	Name : Fedora Core 12 FEDORA-2009-13381 (postgresql) File : nvt/fcore_2009_13381.nasl
2009-12-30	Name : FreeBSD Ports: postgresql-client, postgresql-server File : nvt/freebsd_postgresql-client.nasl
2009-12-16	Name : PostgreSQL NULL Character CA SSL Certificate Validation Security Bypass Vulne... File : nvt/postgressql_37334.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
61039	PostgreSQL Index Function Session Manipulation Privilege Escalation

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0427.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2012-12-28	Name : The remote database server is affected by multiple vulnerabilities. File : postgresql_20091214.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100519_postgresql_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2011-10-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201110-22.nasl - Type : ACT_GATHER_INFO
2011-03-17	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_postgresql-100111.nasl - Type : ACT_GATHER_INFO
2010-10-11	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_postgresql-6768.nasl - Type : ACT_GATHER_INFO
2010-06-01	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2010-05-24	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2010-05-24	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0427.nasl - Type : ACT_GATHER_INFO
2010-05-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0427.nasl - Type : ACT_GATHER_INFO
2010-05-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2010-05-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1964.nasl - Type : ACT_GATHER_INFO
2010-01-19	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12571.nasl - Type : ACT_GATHER_INFO
2010-01-19	Name : The remote openSUSE host is missing a security update. File : suse_11_0_postgresql-100108.nasl - Type : ACT_GATHER_INFO
2010-01-19	Name : The remote openSUSE host is missing a security update. File : suse_11_1_postgresql-100108.nasl - Type : ACT_GATHER_INFO
2010-01-19	Name : The remote openSUSE host is missing a security update. File : suse_11_2_postgresql-100111.nasl - Type : ACT_GATHER_INFO
2010-01-19	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_postgresql-100108.nasl - Type : ACT_GATHER_INFO
2010-01-19	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_postgresql-6767.nasl - Type : ACT_GATHER_INFO
2010-01-04	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-876-1.nasl - Type : ACT_GATHER_INFO
2009-12-18	Name : The remote Fedora host is missing a security update. File : fedora_2009-13381.nasl - Type : ACT_GATHER_INFO
2009-12-18	Name : The remote Fedora host is missing a security update. File : fedora_2009-13363.nasl - Type : ACT_GATHER_INFO
2009-12-17	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_e7bc5600eaa011debd9c00215c6a37bb.nasl - Type : ACT_GATHER_INFO
2009-12-16	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-333.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/37333
BUGTRAQ	http://www.securityfocus.com/archive/1/509917/100/0/threaded
CONFIRM	http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012 http://www.postgresql.org/docs/current/static/release-7-4-27.html http://www.postgresql.org/docs/current/static/release-8-0-23.html http://www.postgresql.org/docs/current/static/release-8-1-19.html http://www.postgresql.org/docs/current/static/release-8-2-15.html http://www.postgresql.org/docs/current/static/release-8-3-9.html http://www.postgresql.org/docs/current/static/release-8-4-2.html http://www.postgresql.org/support/security.html https://bugzilla.redhat.com/show_bug.cgi?id=546321
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-December/msg0103... https://www.redhat.com/archives/fedora-package-announce/2009-December/msg0105...
HP	http://marc.info/?l=bugtraq&m=134124585221119&w=2
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:333
OSVDB	http://osvdb.org/61039
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2010-0427.html http://www.redhat.com/support/errata/RHSA-2010-0428.html http://www.redhat.com/support/errata/RHSA-2010-0429.html
SECTRACK	http://www.securitytracker.com/id?1023326
SECUNIA	http://secunia.com/advisories/37663 http://secunia.com/advisories/39820
SUSE	http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html
VUPEN	http://www.vupen.com/english/advisories/2009/3519 http://www.vupen.com/english/advisories/2010/1197

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:10:32	Multiple Updates
2021-04-22 01:11:00	Multiple Updates
2020-05-23 00:24:39	Multiple Updates
2018-10-11 00:19:43	Multiple Updates
2017-09-19 09:23:31	Multiple Updates
2016-08-23 09:24:35	Multiple Updates
2016-06-28 17:54:46	Multiple Updates
2016-04-26 19:17:16	Multiple Updates
2014-02-17 10:52:31	Multiple Updates
2013-05-11 00:01:44	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	4
CPE ID(s)	92
Sources(s)	26
osvdb(s)	1
Openvas Exploit(s)	12
Nessus® Exploit(s)	26

	Related
8.5	RHSA-2010:0429
8.5	RHSA-2010:0428
8.5	RHSA-2010:0427
8.5	HPSBMU02781 SSR...
8.5	GLSA-201110-22
6.5	USN-876-1
6.5	SUN-274870
6.5	MDVSA-2009:333
6.5	DSA-1964
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 9 more Alert(s)

6.5 - CVE-2009-4136

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU