Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

Two flaws were found in the way the PostgreSQL server handles certain SQL-language functions. An authenticated user could execute a sequence of commands which could crash the PostgreSQL server or possibly read from arbitrary memory locations. A user would need to have permissions to drop and add database tables to be able to exploit these issues (CVE-2007-0555, CVE-2007-0556).

Several denial of service flaws were found in the PostgreSQL server.
An authenticated user could execute certain SQL commands which could crash the PostgreSQL server (CVE-2006-5540, CVE-2006-5541, CVE-2006-5542).

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 8.1.8 which corrects these issues.

Red Hat セキュリティアドバイザリ 2007:0064 から：

2 つのセキュリティ問題を解決する、更新済みの postgresql パッケージが Red Hat Enterprise Linux 3 および 4 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

PostgreSQL は、高度なオブジェクトリレーショナルデータベース管理システム（DBMS）です。

PostgreSQL サーバーが、特定の SQL 言語関数を処理する方法で、欠陥が見つかりました。認証されたユーザーが、PostgreSQL サーバーをクラッシュさせたり、任意のメモリの場所から読み取れたりする、コマンドのシーケンスを実行する可能性があります。この問題を悪用するためには、ユーザーはデータベースのテーブルをドロップまたは追加できる権限が必要です（CVE-2007-0555）。

Red Hat Enterprise Linux 4 システムで実行されている PostgreSQL サーバーに影響を与えるサービス拒否の欠陥が発見されました。認証されたユーザーが、PostgreSQL サーバーをクラッシュさせる SQL コマンドを実行する可能性があります。
(CVE-2006-5540)

PostgreSQL のユーザーは、PostgreSQL バージョン 7.4.16 または 7.3.18 を含んむこれらの更新済みパッケージにアップグレードし、これらの問題を解決する必要があります。

来自 Red Hat 安全公告 2007:0064：

更新后的 postgresql 程序包修复了两个安全问题，现在可用于 Red Hat Enterprise Linux 3 和 4。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

PostgreSQL 是高级对象关系数据库管理系统 (DBMS)。

在 PostgreSQL 服务器处理某些 SQL 语言函数的方式中发现一个缺陷。经过认证的用户可执行可导致 PostgreSQL 服务器崩溃或可能从任意内存位置进行读取的一系列命令。用户需要拥有删除和添加数据库表的权限才能够利用此问题 (CVE-2007-0555)。

已发现一个影响 Red Hat Enterprise Linux 4 系统上运行的 PostgreSQL 服务器的拒绝服务缺陷。经过认证的用户可执行可导致 PostgreSQL 服务器崩溃的 SQL 命令。
(CVE-2006-5540)

PostgreSQL 用户应升级这些更新后的程序包，其中包含已修正了这些问题的 PostgreSQL 版本 7.4.16 或 7.3.18。

A vulnerability in PostgreSQL 8.1.x allowed remote authenticated users to cause a Denial of Service (daemon crash) via certain aggregate functions in an UPDATE statement which were not handled correctly (CVE-2006-5540).

Another DoS issue in PostgreSQL 7.4.x, 8.0.x, and 8.1.x allowed remote authenticated users to crash the daemon via a coercion of an unknown element to ANYARRAY (CVE-2006-5541).

Finally, another vulnerability in 8.1.x could allow a remote authenticated user to cause a DoS related to duration logging of V3-protocol Execute message for COMMIT and ROLLBACK statements (CVE-2006-5542).

This updated provides the latest 8.0.x and 8.1.x PostgreSQL versions and patches the version of PostgreSQL shipped with Corporate 3.0.

After installing this upgrade, you will need to execute 'service postgresql restart' for it to take effect.

The SQL Server PostgreSQL has been updated to fix the following security problems :

  - backend/parser/analyze.c in PostgreSQL 8.1.x allowed     remote authenticated users to cause a denial of service     (daemon crash) via certain aggregate functions in an     UPDATE statement, which are not properly handled during     a 'MIN/MAX index optimization.'. (CVE-2006-5540)

  - backend/parser/parse_coerce.c in PostgreSQL 7.4.1     through 7.4.14, 8.0.x before 8.0.9, and 8.1.x before     8.1.5 allows remote authenticated users to cause a     denial of service (daemon crash) via a coercion of an     unknown element to ANYARRAY. (CVE-2006-5541)

  - backend/tcop/postgres.c in PostgreSQL 8.1.x before 8.1.5     allows remote authenticated users to cause a denial of     service (daemon crash) related to duration logging of     V3-protocol Execute messages for (1) COMMIT and (2)     ROLLBACK SQL statements. (CVE-2006-5542)

來自 Red Hat 安全性公告 2007:0064：

現已提供適用於 Red Hat Enterprise Linux 3 與 4 的更新版 postgresql 套件，可修正兩個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

PostgreSQL 是一種進階物件關聯式資料庫管理系統 (DBMS)。

在 PostgreSQL 伺服器處理特定 SQL 語言函式的方式中發現一個瑕疵。經驗證的使用者可執行一系列命令，其可造成 PostgreSQL 伺服器當機，或可能從任意記憶體位置進行讀取。使用者必須有權限中斷和新增資料庫表格，才可惡意利用此問題 (CVE-2007-0555)。

發現一個拒絕服務瑕疵，其會影響在 Red Hat Enterprise Linux 4 系統上執行的 PostgreSQL 伺服器。經驗證的使用者可執行 SQL 命令，其可造成 PostgreSQL 伺服器當機。
(CVE-2006-5540)

PostgreSQL 使用者應升級至這些更新版套件，其中包含可更正這些問題的 PostgreSQL 7.4.16 和 7.3.18 版。

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw was found in the way the PostgreSQL server handles certain SQL-language functions. An authenticated user could execute a sequence of commands which could crash the PostgreSQL server or possibly read from arbitrary memory locations. A user would need to have permissions to drop and add database tables to be able to exploit this issue (CVE-2007-0555).

A denial of service flaw was found affecting the PostgreSQL server running on Red Hat Enterprise Linux 4 systems. An authenticated user could execute a SQL command which could crash the PostgreSQL server.
(CVE-2006-5540)

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 7.4.16 or 7.3.18, which correct these issues.

Michael Fuhr discovered an incorrect type check when handling unknown literals. By attempting to coerce such a literal to the ANYARRAY type, a local authenticated attacker could cause a server crash.

Josh Drake and Alvaro Herrera reported a crash when using aggregate functions in UPDATE statements. A local authenticated attacker could exploit this to crash the server backend. This update disables this construct, since it is not very well defined and forbidden by the SQL standard.

Sergey Koposov discovered a flaw in the duration logging. This could cause a server crash under certain circumstances.

Please note that these flaws can usually not be exploited through web and other applications that use a database and are exposed to untrusted input, so these flaws do not pose a threat in usual setups.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-369-1 fixed three minor PostgreSQL 8.1 vulnerabilities for Ubuntu 6.06 LTS. This update provides the corresponding update for Ubuntu 6.10.

Michael Fuhr discovered an incorrect type check when handling unknown literals. By attempting to coerce such a literal to the ANYARRAY type, a local authenticated attacker could cause a server crash.
(CVE-2006-5541)

Josh Drake and Alvaro Herrera reported a crash when using aggregate functions in UPDATE statements. A local authenticated attacker could exploit this to crash the server backend. This update disables this construct, since it is not very well defined and forbidden by the SQL standard. (CVE-2006-5540)

Sergey Koposov discovered a flaw in the duration logging.
This could cause a server crash under certain circumstances.
(CVE-2006-5542)

Please note that these flaws can usually not be exploited through web and other applications that use a database and are exposed to untrusted input, so these flaws do not pose a threat in usual setups.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2007:0064 :

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw was found in the way the PostgreSQL server handles certain SQL-language functions. An authenticated user could execute a sequence of commands which could crash the PostgreSQL server or possibly read from arbitrary memory locations. A user would need to have permissions to drop and add database tables to be able to exploit this issue (CVE-2007-0555).

A denial of service flaw was found affecting the PostgreSQL server running on Red Hat Enterprise Linux 4 systems. An authenticated user could execute a SQL command which could crash the PostgreSQL server.
(CVE-2006-5540)

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 7.4.16 or 7.3.18, which correct these issues.

The remote host is running PostgreSQL, an open source relational database.  This version is vulnerable to multiple flaws where an attacker with local access can cause the service to stop.  Successful exploitation would result in the system being unavailable to legitimate users. 

ID	名稱	產品	系列	已發布	已更新	嚴重性
25315	RHEL 5 : postgresql (RHSA-2007:0068)	Nessus	Red Hat Local Security Checks	2007/5/25	2021/1/14	high
67447	Oracle Linux 3/4：postgresql（ELSA-2007-0064）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67447	Oracle Linux 3 / 4：postgresql (ELSA-2007-0064)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
24579	Mandrake Linux Security Advisory : postgresql (MDKSA-2006:194)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	medium
29557	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 2276)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	medium
67447	Oracle Linux 3 / 4 : postgresql (ELSA-2007-0064)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
24290	CentOS 3 / 4 : postgresql (CESA-2007:0064)	Nessus	CentOS Local Security Checks	2007/2/9	2021/1/4	high
24319	RHEL 3 / 4 : postgresql (RHSA-2007:0064)	Nessus	Red Hat Local Security Checks	2007/2/9	2021/1/14	high
27949	Ubuntu 6.06 LTS : postgresql-8.1 vulnerabilities (USN-369-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
27950	Ubuntu 6.10 : postgresql-8.1 vulnerabilities (USN-369-2)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
67447	Oracle Linux 3 / 4 : postgresql (ELSA-2007-0064)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
3798	PostgreSQL Multiple Local DoS Vulnerabilities	Nessus Network Monitor	Database	2006/10/25	2019/3/6	low

偵測

搜尋 Plugin

high

high

high

medium

medium

high

high

high

medium

medium

high

low