PostgreSQL Buffer Overflow in pg_to_ascii() May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1008022
|
|
CVE Reference: CAN-2003-0901
(Links to External Site)
|
Updated: Nov 4 2003
|
Original Entry Date: Oct 28 2003
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 7.2, 7.3
|
Description: Two buffer overflow vulnerabilities were reported in PostgreSQL. A remote user may be able to execute arbitrary code.
In July 2003, some buffer overflow vulnerabilities were reported in PostgreSQL in the pg_to_ascii() function in 'ascii.c'. A remote user may be able to connect to the database service and execute arbitrary code.
|
Impact: A remote user may be able to execute arbitrary code with the privileges of the postgresql service.
|
Solution: The fix has reportedly been added to release 7.2 and 7.3.4 back in July 2003.
A patch is also available at:
http://developer.postgresql.org/cvsweb.cgi/pgsql-server/src/backend/utils/adt/ascii.c
|
Vendor URL: www.postgresql.org/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 28 Oct 2003 14:53:39 -0500
Subject: http://developer.postgresql.org/cvsweb.cgi/pgsql-server/src/backend/utils/adt/ascii.c
|
http://developer.postgresql.org/cvsweb.cgi/pgsql-server/src/backend/utils/adt/ascii.c
A buffer overflow vulnerability was reported in PostgreSQL in the to_ascii() function.
Conectiva reports that a remote user can execute arbitrary code on the target server.
The fix has reportedly been added to release 7.2 and 7.3.4 back in July 2003.
|
|
