Multiple security vulnerabilities have been fixed in PostgrSQL

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

Multiple security vulnerabilities have been fixed in PostgrSQL

  - CVE-2009-3229: allows remote authenticated users to     cause a denial of service

  - CVE-2009-3230: allows remote authenticated users to gain     higher privileges

  - CVE-2009-3231: when using LDAP authentication with     anonymous binds, allows remote attackers to bypass     authentication via an empty password

Several vulnerabilities have been discovered in PostgreSQL, a SQL database system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3229     Authenticated users can shut down the backend server by     re-LOAD-ing libraries in $libdir/plugins, if any     libraries are present there. (The old stable     distribution (etch) is not affected by this issue.)

  - CVE-2009-3230     Authenticated non-superusers can gain database superuser     privileges if they can create functions and tables due     to incorrect execution of functions in functional     indexes.

  - CVE-2009-3231     If PostgreSQL is configured with LDAP authentication,     and the LDAP configuration allows anonymous binds, it is     possible for a user to authenticate themselves with an     empty password. (The old stable distribution (etch) is     not affected by this issue.)

In addition, this update contains reliability improvements which do not target security issues.

Multiple security vulnerabilities have been fixed in PostgreSQL :

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by re-LOAD-ing libraries from a certain plugins directory (CVE-2009-3229).

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600 (CVE-2009-3230).

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password (CVE-2009-3231).

This update provides a fix for this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Updated postgresql packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0039 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

All PostgreSQL users should upgrade to these updated packages, which contain a backported patch to correct this issue. If you are running a PostgreSQL server, the postgresql service must be restarted for this update to take effect.

SunOS 5.10: PostgreSQL 8.3 core patch.
Date this patch was last updated by Sun : Mar/29/13

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1484 advisory.

    PostgreSQL is an advanced object-relational database management system     (DBMS).

    It was discovered that the upstream patch for CVE-2007-6600 included in the     Red Hat Security Advisory RHSA-2008:0038 did not include protection against     misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An     authenticated user could use this flaw to install malicious code that would     later execute with superuser privileges. (CVE-2009-3230)

    A flaw was found in the way PostgreSQL handled encoding conversion. A     remote, authenticated user could trigger an encoding conversion failure,     possibly leading to a temporary denial of service. Note: To exploit this     issue, a locale and client encoding for which specific messages fail to     translate must be selected (the availability of these is determined by an     administrator-defined locale setting). (CVE-2009-0922)

    Note: For Red Hat Enterprise Linux 4, this update upgrades PostgreSQL to     version 7.4.26. For Red Hat Enterprise Linux 5, this update upgrades     PostgreSQL to version 8.1.18. Refer to the PostgreSQL Release Notes for a     list of changes:

    http://www.postgresql.org/docs/7.4/static/release.html     http://www.postgresql.org/docs/8.1/static/release.html

    All PostgreSQL users should upgrade to these updated packages, which     resolve these issues. If the postgresql service is running, it will be     automatically restarted after installing this update.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0038 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

A flaw was found in the way PostgreSQL handled encoding conversion. A remote, authenticated user could trigger an encoding conversion failure, possibly leading to a temporary denial of service. Note: To exploit this issue, a locale and client encoding for which specific messages fail to translate must be selected (the availability of these is determined by an administrator-defined locale setting).
(CVE-2009-0922)

Note: For Red Hat Enterprise Linux 4, this update upgrades PostgreSQL to version 7.4.26. For Red Hat Enterprise Linux 5, this update upgrades PostgreSQL to version 8.1.18. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html http://www.postgresql.org/docs/8.1/static/release.html

All PostgreSQL users should upgrade to these updated packages, which resolve these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1484 advisory.

    [8.1.18-2.el5_4.1]
    - Remove unnecessary .o file that confuses TPS tests     Related: #525284

    [8.1.18-1.el5_4.1]
    - Update to PostgreSQL 8.1.18 to fix CVE-2009-0922, CVE-2009-3230,       and assorted other bugs described at       http://www.postgresql.org/docs/8.1/static/release.html     Resolves: #525284

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

SunOS 5.10: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
41642	SuSE 11 Security Update : PostgreSQL (SAT Patch Number 1319)	Nessus	SuSE Local Security Checks	2009/9/28	2021/1/14	medium
41643	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6500)	Nessus	SuSE Local Security Checks	2009/9/28	2021/1/14	medium
41939	openSUSE Security Update : postgresql (postgresql-1322)	Nessus	SuSE Local Security Checks	2009/9/29	2021/1/14	medium
44765	Debian DSA-1900-1 : postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4 - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
49919	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6535)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	medium
41641	SuSE9 Security Update : PostgreSQL (YOU Patch Number 12509)	Nessus	SuSE Local Security Checks	2009/9/28	2021/1/14	medium
41959	Mandriva Linux Security Advisory : postgresql8.2 (MDVSA-2009:251-1)	Nessus	Mandriva Local Security Checks	2009/10/2	2021/1/6	medium
42059	CentOS 3 : postgresql (CESA-2009:1485)	Nessus	CentOS Local Security Checks	2009/10/8	2021/1/4	medium
107507	Solaris 10 (sparc) : 138826-12	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
41938	openSUSE Security Update : postgresql (postgresql-1322)	Nessus	SuSE Local Security Checks	2009/9/29	2021/1/14	medium
42064	RHEL 4 / 5 : postgresql (RHSA-2009:1484)	Nessus	Red Hat Local Security Checks	2009/10/8	2024/11/4	medium
43800	CentOS 4 / 5 : postgresql (CESA-2009:1484)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	medium
67936	Oracle Linux 5 : postgresql (ELSA-2009-1484)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	medium
107391	Solaris 10 (sparc) : 123590-12	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium