PostgreSQL Data Type Check Bypass and Table Column Modification Bugs Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1017597 |
|
SecurityTracker URL: http://securitytracker.com/id/1017597
|
|
CVE Reference:
CVE-2007-0555, CVE-2007-0556
(Links to External Site)
|
Date: Feb 7 2007
|
Impact:
Denial of service via network, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 7.3, 7.4, 8.0, 8.1, 8.2
|
Description:
A vulnerability was reported in PostgreSQL. A remote authenticated user can cause denial of service conditions.
A remote authenticated user can send specially crafted data to suppress the normal SQL data type checks to cause the backend to crash [CVE-2007-0555].
A remote authenticated user can change the data type of a table column to cause a backend crash [CVE-2007-0556]. This may also be exploited to read portions of the database contents. Only versions 8.0, 8.1, and 8.2 are affected by this second vulnerability.
|
Impact:
A remote authenticated user can cause denial of service conditions on the target system.
A remote authenticated user may be able to read portions of the database contents.
|
Solution:
The vendor has issued fixed versions (7.3.13, 7.4.16, 8.0.11, 8.1.7, 8.2.2).
|
Vendor URL: www.postgresql.org/support/security (Links to External Site)
|
Cause:
Exception handling error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 7 Feb 2007 15:21:30 -0500
Subject: PostgreSQL
|
CVE-2007-0555
Affected: 8.2, 8.1, 8.0, 7.4, 7.3
Fixed in: 8.2.2, 8.1.7, 8.0.11, 7.4.16, 7.3.13
A vulnerability allows suppressing the normal checks that a SQL function returns the
data type it's declared to do. These errors can easily be exploited to cause a backend
crash, and in principle might be used to read database content that the user should not
be able to access.
CVE-2007-0556
Affected: 8.2, 8.1, 8.0
Fixed in: 8.2.2, 8.1.7, 8.0.11
A vulnerability involving changing the data type of a table column can easily be
exploited to cause a backend crash, and in principle might be used to read database
content that the user should not be able to access.
|
|
