Multiple security vulnerabilities have been fixed in PostgrSQL

  - CVE-2009-3229: allows remote authenticated users to     cause a denial of service

  - CVE-2009-3230: allows remote authenticated users to gain     higher privileges

  - CVE-2009-3231: when using LDAP authentication with     anonymous binds, allows remote attackers to bypass     authentication via an empty password

Updated postgresql packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0039 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

All PostgreSQL users should upgrade to these updated packages, which contain a backported patch to correct this issue. If you are running a PostgreSQL server, the postgresql service must be restarted for this update to take effect.

SunOS 5.10: PostgreSQL 8.2 core patch.
Date this patch was last updated by Sun : Jun/09/11

SunOS 5.10_x86: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

SunOS 5.10_x86: PostgreSQL 8.2 core patch.
Date this patch was last updated by Sun : Jun/09/11

SunOS 5.10_x86: PostgreSQL 8.3 core patch.
Date this patch was last updated by Sun : Mar/29/13

Multiple security vulnerabilities have been fixed in PostgrSQL

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0038 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

A flaw was found in the way PostgreSQL handled encoding conversion. A remote, authenticated user could trigger an encoding conversion failure, possibly leading to a temporary denial of service. Note: To exploit this issue, a locale and client encoding for which specific messages fail to translate must be selected (the availability of these is determined by an administrator-defined locale setting).
(CVE-2009-0922)

Note: For Red Hat Enterprise Linux 4, this update upgrades PostgreSQL to version 7.4.26. For Red Hat Enterprise Linux 5, this update upgrades PostgreSQL to version 8.1.18. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html http://www.postgresql.org/docs/8.1/static/release.html

All PostgreSQL users should upgrade to these updated packages, which resolve these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

From Red Hat Security Advisory 2009:1485 :

Updated postgresql packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0039 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

All PostgreSQL users should upgrade to these updated packages, which contain a backported patch to correct this issue. If you are running a PostgreSQL server, the postgresql service must be restarted for this update to take effect.

SunOS 5.10_x86: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

This plugin has been deprecated and either replaced with individual 123591 patch-revision plugins, or deemed non-security related.

The remote host is running PostgreSQL, a database application. The version of PostgreSQL is potentially affected by multiple issues : 

  - Authenticated non-superusers can shut down the backend server by re-LOAD-ing libraries in $libdir/plugins, if any libraries are present there.

  - A privilege escalation issue allows some actions to be performed with superuser privileges instead of table owner privileges.  This is related to the fix for CVE-2007-6600 which failed to include protection against misuse of 'RESET SESSION AUTHORIZATION'.

  - If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.

ID	名稱	產品	系列	已發布	已更新	嚴重性
42031	openSUSE 10 Security Update : postgresql (postgresql-6502)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	medium
42059	CentOS 3 : postgresql (CESA-2009:1485)	Nessus	CentOS Local Security Checks	2009/10/8	2021/1/4	medium
107480	Solaris 10 (sparc) : 136998-10	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
107893	Solaris 10 (x86) : 123591-12	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
107978	Solaris 10 (x86) : 136999-10	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
108005	Solaris 10 (x86) : 138827-12	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
41643	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6500)	Nessus	SuSE Local Security Checks	2009/9/28	2021/1/14	medium
41938	openSUSE Security Update : postgresql (postgresql-1322)	Nessus	SuSE Local Security Checks	2009/9/29	2021/1/14	medium
43800	CentOS 4 / 5 : postgresql (CESA-2009:1484)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	medium
67937	Oracle Linux 3 : postgresql (ELSA-2009-1485)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
24849	Solaris 10 (x86) : 123591-12 (deprecated)	Nessus	Solaris Local Security Checks	2007/3/18	2021/1/14	medium
5170	PostgreSQL Multiple Vulnerabilities	Nessus Network Monitor	Database	2009/9/14	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium