バージョン番号によっては、リモートのPostgreSQLサーバーは複数の欠陥に対して脆弱であるため、リモートデータベースをクエリする権限を持つ攻撃者が、このホストでシェルを取得する可能性があります。

Updated PostgreSQL packages to fix various security flaws are now available for Red Hat Enterprise Linux 3.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw in the LOAD command in PostgreSQL was discovered. A local user could use this flaw to load arbitrary shared librarys and therefore execute arbitrary code, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0227 to this issue.

A permission checking flaw in PostgreSQL was discovered. A local user could bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0244 to this issue.

Multiple buffer overflows were found in PL/PgSQL. A database user who has permissions to create plpgsql functions could trigger this flaw which could lead to arbitrary code execution, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0245 and CVE-2005-0247 to these issues.

A flaw in the integer aggregator (intagg) contrib module for PostgreSQL was found. A user could create carefully crafted arrays and cause a denial of service (crash). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0246 to this issue.

Users of PostgreSQL are advised to update to these erratum packages which are not vulnerable to these issues.

The execution of custom PostgreSQL functions can be restricted with the EXECUTE privilege. However, previous versions did not check this privilege when executing a function which was part of an aggregate. As a result, any database user could circumvent the EXECUTE restriction of functions with a particular (but very common) parameter structure by creating an aggregate wrapper around the function. (CAN-2005-0244)

Several buffer overflows have been discovered in the SQL parser. These could be exploited by any database user to crash the PostgreSQL server or execute arbitrary code with the privileges of the server.
(CAN-2005-0245, CAN-2005-0247)

Finally, this update fixes a Denial of Service vulnerability of the contributed 'intagg' module. By constructing specially crafted arrays, a database user was able to corrupt and crash the PostgreSQL server.
(CAN-2005-0246). Please note that this module is part of the 'postgresql-contrib' package, which is not officially supported by Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:138 advisory.

  - security flaw (CVE-2005-0227, CVE-2005-0244, CVE-2005-0245, CVE-2005-0246, CVE-2005-0247)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities had been reported in various versions of PostgreSQL :

- The EXECUTE restrictions can be bypassed by using the AGGREGATE function, which is missing a permissions check.

- A buffer overflow exists in gram.y which could allow an attacker to execute arbitrary code by sending a large number of arguments to a refcursor function, found in gram.y

- The intagg contributed module allows an attacker to crash the server (Denial of Service) by constructing a malicious crafted array.

根据其版本号，远程 PostgreSQL 服务器容易受到多个缺陷的影响，这些缺陷可允许有权查询远程数据库的攻击者获取此主机上的 shell。

根據版本號碼來判斷，遠端 PostgreSQL 伺服器容易受到多個瑕疵影響，有權查詢遠端資料庫的攻擊者可藉此取得此主機上的殼層。

The remote host is affected by the vulnerability described in GLSA-200502-08 (PostgreSQL: Multiple vulnerabilities)

    PostgreSQL's contains several vulnerabilities:
    John Heasman discovered that the LOAD extension is vulnerable to     local privilege escalation (CAN-2005-0227).
    It is possible to bypass the EXECUTE permission check for functions     (CAN-2005-0244).
    The PL/PgSQL parser is vulnerable to heap-based buffer overflow     (CAN-2005-0244).
    The intagg contrib module is vulnerable to a Denial of Service     (CAN-2005-0246).
  Impact :

    An attacker could exploit this to execute arbitrary code with the     privileges of the PostgreSQL server, bypass security restrictions and     crash the server.
  Workaround :

    There is no know workaround at this time.

A number of vulnerabilities were found and corrected in the PostgreSQL DBMS :

A flaw in the LOAD command could be abused by a local user to load arbitrary shared libraries and as a result execute arbitrary code with the privileges of the user running the postgresql server (CVE-2005-0227).

A permission checking flaw was found where a local user could bypass the EXECUTE permission check for functions using the CREATE AGGREGATE command (CVE-2005-0244).

Multiple buffer overflows were discovered in PL/PgSQL. A database user with permission to create plpgsql functions could trigger these flaws which could then lead to arbitrary code execution with the privileges of the user running the postgresql server (CVE-2005-0245 and CVE-2005-0247).

Finally, a flaw in the integer aggregator (intagg) contrib module was found. A user could create carefully crafted arrays and crash the server, causing a Denial of Service (CVE-2005-0246).

The updated packages have been patched to correct these problems.

The remote PostgreSQL server, according to its version number, is vulnerable to multiple flaws that could allow an attacker who has the rights to query the remote database to obtain a shell on this host.

The remote PostgreSQL server is vulnerable to a number of critical flaws.  Some of these flaws require an attacker to have a valid account with credentials; however, some of the attacks do not require the attacker to have any sort of credentials.

The remote host is running PHP iCalendar, an open-source PHP blog.  This version of iCalendar is vulnerable to a flaw wherein a local user can gain access to confidential data by requesting the data from the iCalendar application.  Successful exploitation would lead to a local user gaining access to confidential data.  In addition, the remote host is vulnerable to a remote file upload flaw.  An attacker exploiting this flaw would be able to manipulate the application into uploading and executing potentially malicious scripts.  

ID	名稱	產品	系列	已發布	已更新	嚴重性
16309	PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1の複数の脆弱性	Nessus	Databases	2005/2/3	2022/4/11	medium
16386	RHEL 3 : rh-postgresql (RHSA-2005:141)	Nessus	Red Hat Local Security Checks	2005/2/14	2021/1/14	high
20702	Ubuntu 4.10 : postgresql vulnerabilities (USN-79-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	high
17192	RHEL 4 : postgresql (RHSA-2005:138)	Nessus	Red Hat Local Security Checks	2005/2/22	2024/4/27	critical
22210	FreeBSD : postgresql -- multiple vulnerabilities (65c8ecf9-2adb-11db-a6e2-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	2006/8/14	2021/1/6	high
16309	PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 多个漏洞	Nessus	Databases	2005/2/3	2022/4/11	medium
16309	PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 多個弱點	Nessus	Databases	2005/2/3	2022/4/11	medium
16445	GLSA-200502-08 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/2/14	2021/1/6	high
17139	Mandrake Linux Security Advisory : postgresql (MDKSA-2005:040)	Nessus	Mandriva Local Security Checks	2005/2/18	2021/1/6	high
16309	PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 Multiple Vulnerabilities	Nessus	Databases	2005/2/3	2022/4/11	medium
2583	PostgreSQL < 8.0.1 Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	2005/2/1	2019/3/6	medium
3479	PHP iCalendar Local File Inclusion	Nessus Network Monitor	CGI	2006/3/17	2019/3/6	high

偵測

搜尋 Plugin

medium

high

high

critical

high

medium

medium

high

high

medium

medium

high