Executive Summary

Informations
Name CVE-2010-1975 First vendor Publication 2010-05-19
Vendor Cve Last vendor Modification 2017-09-19

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:N)
Cvss Base Score 5.5 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1975

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11004
 
Oval ID: oval:org.mitre.oval:def:11004
Title: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
Description: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1975
 Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11655
 
Oval ID: oval:org.mitre.oval:def:11655
Title: DSA-2051 postgresql-8.3 -- several vulnerabilities
Description: Several local vulnerabilities have been discovered in PostgreSQL, an object-relational SQL database. The Common Vulnerabilities and Exposures project identifies the following problems: Tim Bunce discovered that the implementation of the procedural language PL/Perl insufficiently restricts the subset of allowed code, which allows authenticated users the execution of arbitrary Perl code. Tom Lane discovered that the implementation of the procedural language PL/Tcl insufficiently restricts the subset of allowed code, which allows authenticated users the execution of arbitrary Tcl code. It was discovered that an unprivileged user could reset superuser-only parameter settings.
Family: unix Class: patch
Reference(s): DSA-2051
CVE-2010-0442
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): postgresql-8.3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13487
 
Oval ID: oval:org.mitre.oval:def:13487
Title: USN-942-1 -- postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerabilities
Description: It was discovered that the Safe.pm module as used by PostgreSQL did not properly restrict PL/perl procedures. If PostgreSQL was configured to use Perl stored procedures, a remote authenticated attacker could exploit this to execute arbitrary Perl code. It was discovered that PostgreSQL did not properly check permissions to restrict PL/Tcl procedures. If PostgreSQL was configured to use Tcl stored procedures, a remote authenticated attacker could exploit this to execute arbitrary Tcl code
Family: unix Class: patch
Reference(s): USN-942-1
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 6.06
Ubuntu 9.04
 Product(s): postgresql-8.1
postgresql-8.3
postgresql-8.4
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13636
 
Oval ID: oval:org.mitre.oval:def:13636
Title: DSA-2051-1 postgresql-8.3 -- several
Description: Several local vulnerabilities have been discovered in PostgreSQL, an object-relational SQL database. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2010-1169 Tim Bunce discovered that the implementation of the procedural language PL/Perl insufficiently restricts the subset of allowed code, which allows authenticated users the execution of arbitrary Perl code. CVE-2010-1170 Tom Lane discovered that the implementation of the procedural language PL/Tcl insufficiently restricts the subset of allowed code, which allows authenticated users the execution of arbitrary Tcl code. CVE-2010-1975 It was discovered that an unprivileged user could reset superuser-only parameter settings. For the stable distribution, these problems have been fixed in version 8.3.11-0lenny1. This update also introduces a fix for CVE-2010-0442, which was originally scheduled for the next Lenny point update. For the unstable distribution, these problems have been fixed in version 8.4.4-1 of postgresql-8.4. We recommend that you upgrade your postgresql-8.3 packages.
Family: unix Class: patch
Reference(s): DSA-2051-1
CVE-2010-0442
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): postgresql-8.3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21774
 
Oval ID: oval:org.mitre.oval:def:21774
Title: RHSA-2010:0429: postgresql security update (Moderate)
Description: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
Family: unix Class: patch
Reference(s): RHSA-2010:0429-01
CESA-2010:0429
CVE-2009-4136
CVE-2010-0442
CVE-2010-0733
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 81
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): postgresql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22142
 
Oval ID: oval:org.mitre.oval:def:22142
Title: RHSA-2010:0430: postgresql84 security update (Moderate)
Description: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
Family: unix Class: patch
Reference(s): RHSA-2010:0430-01
CESA-2010:0430
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 42
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): postgresql84
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22939
 
Oval ID: oval:org.mitre.oval:def:22939
Title: ELSA-2010:0429: postgresql security update (Moderate)
Description: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
Family: unix Class: patch
Reference(s): ELSA-2010:0429-01
CVE-2009-4136
CVE-2010-0442
CVE-2010-0733
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 29
Platform(s): Oracle Linux 5
 Product(s): postgresql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23110
 
Oval ID: oval:org.mitre.oval:def:23110
Title: ELSA-2010:0430: postgresql84 security update (Moderate)
Description: PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
Family: unix Class: patch
Reference(s): ELSA-2010:0430-01
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 17
Platform(s): Oracle Linux 5
 Product(s): postgresql84
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27970
 
Oval ID: oval:org.mitre.oval:def:27970
Title: DEPRECATED: ELSA-2010-0429 -- postgresql security update (moderate)
Description: [8.1.21-1.el5_5.1] - Update to PostgreSQL 8.1.21 to fix CVE-2010-1169, CVE-2010-1170, CVE-2009-4136, CVE-2010-0733, CVE-2010-0442, and assorted other bugs described at http://www.postgresql.org/docs/8.1/static/release.html Resolves: #586058
Family: unix Class: patch
Reference(s): ELSA-2010-0429
CVE-2009-4136
CVE-2010-0442
CVE-2010-0733
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 4
Platform(s): Oracle Linux 5
 Product(s): postgresql
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28185
 
Oval ID: oval:org.mitre.oval:def:28185
Title: DEPRECATED: ELSA-2010-0430 -- postgresql84 security update (moderate)
Description: [8.4.4-1.el5_5.1] - Update to PostgreSQL 8.4.4, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-4.html including fixes for CVE-2010-1169 and CVE-2010-1170 Resolves: #586060
Family: unix Class: patch
Reference(s): ELSA-2010-0430
CVE-2010-1169
CVE-2010-1170
CVE-2010-1975
 Version: 4
Platform(s): Oracle Linux 5
 Product(s): postgresql84
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 110

OpenVAS Exploits

Date Description
2012-02-12 Name : Gentoo Security Advisory GLSA 201110-22 (postgresql-server postgresql-base)
File : nvt/glsa_201110_22.nasl
2010-06-03 Name : Debian Security Advisory DSA 2051-1 (postgresql-8.3)
File : nvt/deb_2051_1.nasl
2010-05-28 Name : Mandriva Update for postgresql MDVSA-2010:103 (postgresql)
File : nvt/gb_mandriva_MDVSA_2010_103.nasl
2010-05-21 Name : PostgreSQL 'RESET ALL' Unauthorized Access Vulnerability
File : nvt/gb_postgresql_40304.nasl
2010-03-22 Name : Mandriva Update for poppler MDVA-2010:103 (poppler)
File : nvt/gb_mandriva_MDVA_2010_103.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
64792 PostgreSQL RESET ALL Operation Privilege Check Weakness Arbitrary Parameter S...

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0430.nasl - Type : ACT_GATHER_INFO
2012-12-28 Name : The remote database server is affected by multiple vulnerabilities.
File : postgresql_20100517.nasl - Type : ACT_GATHER_INFO
2011-10-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201110-22.nasl - Type : ACT_GATHER_INFO
2010-12-02 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_postgresql-100525.nasl - Type : ACT_GATHER_INFO
2010-10-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_postgresql-7053.nasl - Type : ACT_GATHER_INFO
2010-07-14 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_postgresql-100525.nasl - Type : ACT_GATHER_INFO
2010-07-14 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_postgresql-100525.nasl - Type : ACT_GATHER_INFO
2010-07-14 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_postgresql-100525.nasl - Type : ACT_GATHER_INFO
2010-06-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2010-06-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0430.nasl - Type : ACT_GATHER_INFO
2010-05-25 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2051.nasl - Type : ACT_GATHER_INFO
2010-05-24 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0428.nasl - Type : ACT_GATHER_INFO
2010-05-24 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-942-1.nasl - Type : ACT_GATHER_INFO
2010-05-21 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-103.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0429.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0430.nasl - Type : ACT_GATHER_INFO
2010-05-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0428.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/40304
CONFIRM http://www.postgresql.org/docs/current/static/release-7-4-29.html
http://www.postgresql.org/docs/current/static/release-8-0-25.html
http://www.postgresql.org/docs/current/static/release-8-1-21.html
http://www.postgresql.org/docs/current/static/release-8-2-17.html
http://www.postgresql.org/docs/current/static/release-8-3-11.html
http://www.postgresql.org/docs/current/static/release-8-4-4.html
DEBIAN http://www.debian.org/security/2010/dsa-2051
HP http://marc.info/?l=bugtraq&m=134124585221119&w=2
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2010:103
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SECUNIA http://secunia.com/advisories/39939
SUSE http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
VUPEN http://www.vupen.com/english/advisories/2010/1207
http://www.vupen.com/english/advisories/2010/1221

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
Date Informations
2021-05-04 12:11:38
  • Multiple Updates
2021-04-22 01:12:13
  • Multiple Updates
2020-05-23 00:25:51
  • Multiple Updates
2017-09-19 09:23:48
  • Multiple Updates
2016-08-23 09:24:37
  • Multiple Updates
2016-04-26 19:50:17
  • Multiple Updates
2014-02-17 10:55:37
  • Multiple Updates
2013-05-10 23:25:40
  • Multiple Updates