The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-661:02 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a remote PostgreSQL server, you need this package. You     also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
     CVE-2012-0866     CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x     before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER,     which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by     installing the trigger on an attacker-owned table.
     CVE-2012-0867     PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to     only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections     when the host name is exactly 32 characters.
     CVE-2012-0868     CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x     before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL     commands via a crafted file containing object names with newlines, which are inserted into an SQL script     that is used when the database is restored.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x     before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER,     which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by     installing the trigger on an attacker-owned table. (CVE-2012-0866)

Note that Nessus relies on the presence of the package as reported by the vendor.

Update to latest Postgres releases --- resolves some security and data loss bugs http://www.postgresql.org/docs/9.1/static/release-9-1-3.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in postgresql :

Permissions on a function called by a trigger are not properly checked (CVE-2012-0866).

SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third-party certificate authorities (CVE-2012-0867).

Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pg_dump file (CVE-2012-0868).

This advisory provides the latest versions of PostgreSQL that is not vulnerable to these issues.

It was discovered that PostgreSQL incorrectly checked permissions on functions called by a trigger. An attacker could attach a trigger to a table they owned and possibly escalate privileges. (CVE-2012-0866)

It was discovered that PostgreSQL incorrectly truncated SSL certificate name checks to 32 characters. If a host name was exactly 32 characters, this issue could be exploited by an attacker to spoof the SSL certificate. This issue affected Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. (CVE-2012-0867)

It was discovered that the PostgreSQL pg_dump utility incorrectly filtered line breaks in object names. An attacker could create object names that execute arbitrary SQL commands when a dump script is reloaded. (CVE-2012-0868).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0677 advisory.

    - Back-port upstream fixes for CVE-2012-0866 and CVE-2012-0868     Resolves: #812070

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Postgresql was updated to the security and bugfix release 9.1.3 :

  - Require execute permission on the trigger function for     'CREATE TRIGGER' (CVE-2012-0866, bnc#749299).

  - Remove arbitrary limitation on length of common name in     SSL certificates (CVE-2012-0867, bnc#749301).

  - Convert newlines to spaces in names written in pg_dump     comments (CVE-2012-0868, bnc#749303).

  - See the release notes for the rest of the changes:
    http://www.postgresql.org/docs/9.1/static/release.html     /usr/share/doc/packages/postgresql/HISTORY

  - This also fixes bnc#701489.

The version of PostgreSQL installed on the remote host is 8.3.x prior to 8.3.18, and is, therefore, potentially affected by multiple vulnerabilities :

  - Permissions on a function called by a trigger are not     properly checked. (CVE-2012-0866)   
  - Line breaks in object names can be exploited to execute     arbitrary SQL commands when reloading a pg_dump file.
    (CVE-2012-0868)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-570:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a remote PostgreSQL server, you need this package. You     also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
    CVE-2012-0866     CVE-2012-0868     No description available at the time of writing, please use the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

PostgreSQL is an advanced object-relational database management system (DBMS).

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
283904	MiracleLinux 4 : postgresql-8.4.12-1.0.1.AXS4 (AXSA:2012-661:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
217628	Linux Distros Unpatched Vulnerability : CVE-2012-0866	Nessus	Misc.	2025/3/4	2026/1/28	critical
58281	Fedora 15 : postgresql-9.0.7-1.fc15 (2012-2589)	Nessus	Fedora Local Security Checks	2012/3/8	2021/1/11	medium
58177	Mandriva Linux Security Advisory : postgresql (MDVSA-2012:026)	Nessus	Mandriva Local Security Checks	2012/3/1	2021/1/6	medium
58168	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1378-1)	Nessus	Ubuntu Local Security Checks	2012/2/29	2019/9/19	medium
68528	Oracle Linux 5 : postgresql (ELSA-2012-0677)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
74756	openSUSE Security Update : postgresql (openSUSE-SU-2012:1173-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
63355	PostgreSQL 8.3 < 8.3.18 Multiple Vulnerabilities	Nessus	Databases	2012/12/28	2026/1/22	high
284271	MiracleLinux 3 : postgresql-8.1.23-4.0.1.AXS3 (AXSA:2012-570:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
69689	Amazon Linux AMI : postgresql8 (ALAS-2012-82)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
61317	Scientific Linux Security Update : postgresql on SL5.x i386/x86_64 (20120521)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

检测

插件搜索

critical

critical

medium

medium

medium

critical

medium

high

critical

medium

medium