The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-415:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a remote PostgreSQL server, you need this package. You     also need to install this package if you're installing the postgresql-server package.
    Security bugs fixed with this release;
    CVE-2009-0922     PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a     denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized     error message to a client-specified encoding, as demonstrated using mismatched encoding conversion     requests.
    CVE-2009-3230     The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before     8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET     ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain     privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security vulnerabilities have been fixed in PostgrSQL

  - CVE-2009-3229: allows remote authenticated users to     cause a denial of service

  - CVE-2009-3230: allows remote authenticated users to gain     higher privileges

  - CVE-2009-3231: when using LDAP authentication with     anonymous binds, allows remote attackers to bypass     authentication via an empty password

Updated postgresql packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0039 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

All PostgreSQL users should upgrade to these updated packages, which contain a backported patch to correct this issue. If you are running a PostgreSQL server, the postgresql service must be restarted for this update to take effect.

SunOS 5.10: PostgreSQL 8.2 core patch.
Date this patch was last updated by Sun : Jun/09/11

Several vulnerabilities have been discovered in PostgreSQL, a SQL database system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3229     Authenticated users can shut down the backend server by     re-LOAD-ing libraries in $libdir/plugins, if any     libraries are present there. (The old stable     distribution (etch) is not affected by this issue.)

  - CVE-2009-3230     Authenticated non-superusers can gain database superuser     privileges if they can create functions and tables due     to incorrect execution of functions in functional     indexes.

  - CVE-2009-3231     If PostgreSQL is configured with LDAP authentication,     and the LDAP configuration allows anonymous binds, it is     possible for a user to authenticate themselves with an     empty password. (The old stable distribution (etch) is     not affected by this issue.)

In addition, this update contains reliability improvements which do not target security issues.

Update to PostgreSQL 8.3.8, for various fixes described at http://www.postgresql.org/docs/8.3/static/release-8-3-8.html including three security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security vulnerabilities have been fixed in PostgrSQL

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

It was discovered that PostgreSQL could be made to unload and reload an already loaded module by using the LOAD command. A remote authenticated attacker could exploit this to cause a denial of service. This issue did not affect Ubuntu 6.06 LTS. (CVE-2009-3229)

Due to an incomplete fix for CVE-2007-6600, RESET ROLE and RESET SESSION AUTHORIZATION operations were allowed inside security-definer functions. A remote authenticated attacker could exploit this to escalate privileges within PostgreSQL. (CVE-2009-3230)

It was discovered that PostgreSQL did not properly perform LDAP authentication under certain circumstances. When configured to use LDAP with anonymous binds, a remote attacker could bypass authentication by supplying an empty password. This issue did not affect Ubuntu 6.06 LTS. (CVE-2009-3231).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by re-LOAD-ing libraries from a certain plugins directory (CVE-2009-3229).

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600 (CVE-2009-3230).

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password (CVE-2009-3231).

This update provides a fix for this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Multiple security vulnerabilities have been fixed in PostgreSQL :

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284124	MiracleLinux 3 : postgresql-8.1.18-2.1.1AXS3 (AXSA:2009-415:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
42031	openSUSE 10 Security Update : postgresql (postgresql-6502)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	medium
42065	RHEL 3 : postgresql (RHSA-2009:1485)	Nessus	Red Hat Local Security Checks	2009/10/8	2021/1/14	medium
107480	Solaris 10 (sparc) : 136998-10	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	medium
44765	Debian DSA-1900-1 : postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4 - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
40954	Fedora 10 : postgresql-8.3.8-1.fc10 (2009-9474)	Nessus	Fedora Local Security Checks	2009/9/14	2021/1/11	medium
41642	SuSE 11 Security Update : PostgreSQL (SAT Patch Number 1319)	Nessus	SuSE Local Security Checks	2009/9/28	2021/1/14	medium
41939	openSUSE Security Update : postgresql (postgresql-1322)	Nessus	SuSE Local Security Checks	2009/9/29	2021/1/14	medium
49919	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6535)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	medium
41045	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : postgresql-8.1, postgresql-8.3 vulnerabilities (USN-834-1)	Nessus	Ubuntu Local Security Checks	2009/9/22	2021/1/19	medium
41643	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6500)	Nessus	SuSE Local Security Checks	2009/9/28	2021/1/14	medium
41959	Mandriva Linux Security Advisory : postgresql8.2 (MDVSA-2009:251-1)	Nessus	Mandriva Local Security Checks	2009/10/2	2021/1/6	medium
42059	CentOS 3 : postgresql (CESA-2009:1485)	Nessus	CentOS Local Security Checks	2009/10/8	2021/1/4	medium
41641	SuSE9 Security Update : PostgreSQL (YOU Patch Number 12509)	Nessus	SuSE Local Security Checks	2009/9/28	2021/1/14	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium