ID CVE-2012-0868
Summary CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
References
Vulnerable Configurations
  • PostgreSQL 8.3.11
    cpe:2.3:a:postgresql:postgresql:8.3.11
  • PostgreSQL 8.3.8
    cpe:2.3:a:postgresql:postgresql:8.3.8
  • PostgreSQL 8.3.13
    cpe:2.3:a:postgresql:postgresql:8.3.13
  • PostgreSQL 8.3.6
    cpe:2.3:a:postgresql:postgresql:8.3.6
  • PostgreSQL 8.3.10
    cpe:2.3:a:postgresql:postgresql:8.3.10
  • PostgreSQL 8.3.9
    cpe:2.3:a:postgresql:postgresql:8.3.9
  • PostgreSQL 8.3.7
    cpe:2.3:a:postgresql:postgresql:8.3.7
  • PostgreSQL 8.3.5
    cpe:2.3:a:postgresql:postgresql:8.3.5
  • PostgreSQL 8.3.2
    cpe:2.3:a:postgresql:postgresql:8.3.2
  • PostgreSQL 8.3.1
    cpe:2.3:a:postgresql:postgresql:8.3.1
  • PostgreSQL 8.3.4
    cpe:2.3:a:postgresql:postgresql:8.3.4
  • PostgreSQL 8.3.3
    cpe:2.3:a:postgresql:postgresql:8.3.3
  • PostgreSQL 8.3
    cpe:2.3:a:postgresql:postgresql:8.3
  • PostgreSQL 8.3.12
    cpe:2.3:a:postgresql:postgresql:8.3.12
  • PostgreSQL 8.3.17
    cpe:2.3:a:postgresql:postgresql:8.3.17
  • PostgreSQL 8.3.16
    cpe:2.3:a:postgresql:postgresql:8.3.16
  • PostgreSQL 8.3.15
    cpe:2.3:a:postgresql:postgresql:8.3.15
  • PostgreSQL 8.3.14
    cpe:2.3:a:postgresql:postgresql:8.3.14
  • PostgreSQL 8.4.5
    cpe:2.3:a:postgresql:postgresql:8.4.5
  • PostgreSQL 8.4.1
    cpe:2.3:a:postgresql:postgresql:8.4.1
  • PostgreSQL 8.4.6
    cpe:2.3:a:postgresql:postgresql:8.4.6
  • PostgreSQL 8.4
    cpe:2.3:a:postgresql:postgresql:8.4
  • PostgreSQL 8.4.2
    cpe:2.3:a:postgresql:postgresql:8.4.2
  • PostgreSQL 8.4.3
    cpe:2.3:a:postgresql:postgresql:8.4.3
  • PostgreSQL 8.4.4
    cpe:2.3:a:postgresql:postgresql:8.4.4
  • PostgreSQL 8.4.7
    cpe:2.3:a:postgresql:postgresql:8.4.7
  • PostgreSQL 8.4.8
    cpe:2.3:a:postgresql:postgresql:8.4.8
  • PostgreSQL 8.4.9
    cpe:2.3:a:postgresql:postgresql:8.4.9
  • PostgreSQL 8.4.10
    cpe:2.3:a:postgresql:postgresql:8.4.10
  • PostgreSQL 9.0
    cpe:2.3:a:postgresql:postgresql:9.0
  • PostgreSQL 9.0.1
    cpe:2.3:a:postgresql:postgresql:9.0.1
  • PostgreSQL 9.0.2
    cpe:2.3:a:postgresql:postgresql:9.0.2
  • PostgreSQL 9.0.3
    cpe:2.3:a:postgresql:postgresql:9.0.3
  • PostgreSQL 9.0.4
    cpe:2.3:a:postgresql:postgresql:9.0.4
  • PostgreSQL 9.0.5
    cpe:2.3:a:postgresql:postgresql:9.0.5
  • PostgreSQL 9.0.6
    cpe:2.3:a:postgresql:postgresql:9.0.6
  • PostgreSQL 9.1
    cpe:2.3:a:postgresql:postgresql:9.1
  • PostgreSQL 9.1.1
    cpe:2.3:a:postgresql:postgresql:9.1.1
  • PostgreSQL 9.1.2
    cpe:2.3:a:postgresql:postgresql:9.1.2
CVSS
Base: 6.8 (as of 19-07-2012 - 11:43)
Impact:
Exploitability:
CWE CWE-89
CAPEC
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Object Relational Mapping Injection
    An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.
  • SQL Injection through SOAP Parameter Tampering
    An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.
  • Expanding Control over the Operating System from the Database
    An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
  • SQL Injection
    This attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs actions other than those the application intended. SQL Injection results from failure of the application to appropriately validate input. When specially crafted user-controlled input consisting of SQL syntax is used without proper validation as part of SQL queries, it is possible to glean information from the database in ways not envisaged during application design. Depending upon the database and the design of the application, it may also be possible to leverage injection to have the database execute system-related commands of the attackers' choice. SQL Injection enables an attacker to talk directly to the database, thus bypassing the application completely. Successful injection can cause information disclosure as well as ability to add or modify data in the database. In order to successfully inject SQL and retrieve information from a database, an attacker:
  • Blind SQL Injection
    Blind SQL Injection results from an insufficient mitigation for SQL Injection. Although suppressing database error messages are considered best practice, the suppression alone is not sufficient to prevent SQL Injection. Blind SQL Injection is a form of SQL Injection that overcomes the lack of error messages. Without the error messages that facilitate SQL Injection, the attacker constructs input strings that probe the target through simple Boolean SQL expressions. The attacker can determine if the syntax and structure of the injection was successful based on whether the query was executed or not. Applied iteratively, the attacker determines how and where the target is vulnerable to SQL Injection. For example, an attacker may try entering something like "username' AND 1=1; --" in an input field. If the result is the same as when the attacker entered "username" in the field, then the attacker knows that the application is vulnerable to SQL Injection. The attacker can then ask yes/no questions from the database server to extract information from it. For example, the attacker can extract table names from a database using the following types of queries: If the above query executes properly, then the attacker knows that the first character in a table name in the database is a letter between m and z. If it doesn't, then the attacker knows that the character must be between a and l (assuming of course that table names only contain alphabetic characters). By performing a binary search on all character positions, the attacker can determine all table names in the database. Subsequently, the attacker may execute an actual attack and send something like:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201209-24.NASL
    description The remote host is affected by the vulnerability described in GLSA-201209-24 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could spoof SSL connections. Furthermore, a remote authenticated attacker could cause a Denial of Service, read and write arbitrary files, inject SQL commands into dump scripts, or bypass database restrictions to execute database functions. A context-dependent attacker could more easily obtain access via authentication attempts with an initial substring of the intended password. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 62380
    published 2012-09-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=62380
    title GLSA-201209-24 : PostgreSQL: Multiple vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2012-0677.NASL
    description Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 59222
    published 2012-05-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59222
    title RHEL 5 : postgresql (RHSA-2012:0677)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2012-0677.NASL
    description Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 59213
    published 2012-05-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59213
    title CentOS 5 : postgresql (CESA-2012:0677)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2012-0677.NASL
    description From Red Hat Security Advisory 2012:0677 : Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68528
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68528
    title Oracle Linux 5 : postgresql (ELSA-2012-0677)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2012-214.NASL
    description - Security and bugfix release 9.1.3 : - Require execute permission on the trigger function for 'CREATE TRIGGER' (CVE-2012-0866, bnc#749299). - Remove arbitrary limitation on length of common name in SSL certificates (CVE-2012-0867, bnc#749301). - Convert newlines to spaces in names written in pg_dump comments (CVE-2012-0868, bnc#749303). See the release notes for the rest of the changes: http://www.postgresql.org/docs/9.1/static/release-9-1-3.html /usr/share/doc/packages/postgresql/HISTORY
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 74591
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74591
    title openSUSE Security Update : postgresql (openSUSE-SU-2012:0480-1)
  • NASL family Databases
    NASL id POSTGRESQL_8318.NASL
    description The version of PostgreSQL installed on the remote host is 8.3.x prior to 8.3.18, and is, therefore, potentially affected by multiple vulnerabilities : - Permissions on a function called by a trigger are not properly checked. (CVE-2012-0866) - Line breaks in object names can be exploited to execute arbitrary SQL commands when reloading a pg_dump file. (CVE-2012-0868)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 63355
    published 2012-12-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63355
    title PostgreSQL 8.3 < 8.3.18 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_POSTGRESQL-8071.NASL
    description - Security and bugfix release : - Require execute permission on the trigger function for CREATE TRIGGER. (CVE-2012-0866, bnc#749299) - Convert newlines to spaces in names written in pg_dump comments. (CVE-2012-0868, bnc#749303) Please see the PostgreSQL release notes document for full changelog and details : http://www.postgresql.org/docs/8.3/static/release.html
    last seen 2019-02-21
    modified 2012-12-03
    plugin id 59384
    published 2012-06-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59384
    title SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 8071)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_POSTGRESQL-120322.NASL
    description - Security and bugfix release 8.3.18 : - Require execute permission on the trigger function for CREATE TRIGGER. (CVE-2012-0866, bnc#749299) - Convert newlines to spaces in names written in pg_dump comments (CVE-2012-0868, bnc#749303). Please see the PostgreSQL release notes document for full changelog and details : http://www.postgresql.org/docs/8.3/static/release.html
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 64215
    published 2013-01-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64215
    title SuSE 11.1 Security Update : PostgreSQL (SAT Patch Number 6023)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20120521_POSTGRESQL_ON_SL5_X.NASL
    description PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61317
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61317
    title Scientific Linux Security Update : postgresql on SL5.x i386/x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2012-0678.NASL
    description Updated postgresql84 and postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) These updated packages upgrade PostgreSQL to version 8.4.11, which fixes these issues as well as several data-corruption issues and lesser non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes : http://www.postgresql.org/docs/8.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 59223
    published 2012-05-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59223
    title RHEL 5 / 6 : postgresql and postgresql84 (RHSA-2012:0678)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1378-1.NASL
    description It was discovered that PostgreSQL incorrectly checked permissions on functions called by a trigger. An attacker could attach a trigger to a table they owned and possibly escalate privileges. (CVE-2012-0866) It was discovered that PostgreSQL incorrectly truncated SSL certificate name checks to 32 characters. If a host name was exactly 32 characters, this issue could be exploited by an attacker to spoof the SSL certificate. This issue affected Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. (CVE-2012-0867) It was discovered that the PostgreSQL pg_dump utility incorrectly filtered line breaks in object names. An attacker could create object names that execute arbitrary SQL commands when a dump script is reloaded. (CVE-2012-0868). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 58168
    published 2012-02-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58168
    title Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1378-1)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2012-026.NASL
    description Multiple vulnerabilities has been discovered and corrected in postgresql : Permissions on a function called by a trigger are not properly checked (CVE-2012-0866). SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third-party certificate authorities (CVE-2012-0867). Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pg_dump file (CVE-2012-0868). This advisory provides the latest versions of PostgreSQL that is not vulnerable to these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 58177
    published 2012-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58177
    title Mandriva Linux Security Advisory : postgresql (MDVSA-2012:026)
  • NASL family Databases
    NASL id POSTGRESQL_20120227.NASL
    description The version of PostgreSQL installed on the remote host is 8.4.x prior to 8.4.11, 9.0.x prior to 9.0.7, or 9.1.x prior to 9.1.3. It is, therefore, potentially affected by multiple vulnerabilities : - Permissions on a function called by a trigger are not properly checked. (CVE-2012-0866) - SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third-party certificate authorities. (CVE-2012-0867) - Line breaks in object names can be exploited to execute arbitrary SQL commands when reloading a pg_dump file. (CVE-2012-0868)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 63352
    published 2012-12-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=63352
    title PostgreSQL 8.4 < 8.4.11 / 9.0 < 9.0.7 / 9.1 < 9.1.3 Multiple Vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20120521_POSTGRESQL_AND_POSTGRESQL84_ON_SL5_X.NASL
    description PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) These updated packages upgrade PostgreSQL to version 8.4.11, which fixes these issues as well as several data-corruption issues and lesser non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes : http://www.postgresql.org/docs/8.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61316
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61316
    title Scientific Linux Security Update : postgresql and postgresql84 on SL5.x, SL6.x i386/x86_64
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-2589.NASL
    description Update to latest Postgres releases --- resolves some security and data loss bugs http://www.postgresql.org/docs/9.1/static/release-9-1-3.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-24
    plugin id 58281
    published 2012-03-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58281
    title Fedora 15 : postgresql-9.0.7-1.fc15 (2012-2589)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2012-0678.NASL
    description From Red Hat Security Advisory 2012:0678 : Updated postgresql84 and postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) These updated packages upgrade PostgreSQL to version 8.4.11, which fixes these issues as well as several data-corruption issues and lesser non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes : http://www.postgresql.org/docs/8.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68529
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68529
    title Oracle Linux 5 / 6 : postgresql / postgresql84 (ELSA-2012-0678)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2012-82.NASL
    description The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 69689
    published 2013-09-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69689
    title Amazon Linux AMI : postgresql8 (ALAS-2012-82)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2418.NASL
    description Several local vulnerabilities have been discovered in PostgreSQL, an object-relational SQL database. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2012-0866 It was discovered that the permissions of a function called by a trigger are not checked. This could result in privilege escalation. - CVE-2012-0867 It was discovered that only the first 32 characters of a host name are checked when validating host names through SSL certificates. This could result in spoofing the connection in limited circumstances. - CVE-2012-0868 It was discovered that pg_dump did not sanitise object names. This could result in arbitrary SQL command execution if a malformed dump file is opened.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 58135
    published 2012-02-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58135
    title Debian DSA-2418-1 : postgresql-8.4 - several vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-2508.NASL
    description Update to latest Postgres releases --- resolves some security and data loss bugs http://www.postgresql.org/docs/9.1/static/release-9-1-3.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-24
    plugin id 58257
    published 2012-03-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58257
    title Fedora 17 : postgresql-9.1.3-1.fc17 (2012-2508)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_174B8864623711E1BE1814DAE938EC40.NASL
    description The PostgreSQL Global Development Group reports : These vulnerabilities could allow users to define triggers that execute functions on which the user does not have EXECUTE permission, allow SSL certificate spoofing and allow line breaks in object names to be exploited to execute code when loading a pg_dump file.
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 58162
    published 2012-02-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58162
    title FreeBSD : databases/postgresql*-client -- multiple vulnerabilities (174b8864-6237-11e1-be18-14dae938ec40)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2012-603.NASL
    description Postgresql was updated to the security and bugfix release 9.1.3 : - Require execute permission on the trigger function for 'CREATE TRIGGER' (CVE-2012-0866, bnc#749299). - Remove arbitrary limitation on length of common name in SSL certificates (CVE-2012-0867, bnc#749301). - Convert newlines to spaces in names written in pg_dump comments (CVE-2012-0868, bnc#749303). - See the release notes for the rest of the changes: http://www.postgresql.org/docs/9.1/static/release.html /usr/share/doc/packages/postgresql/HISTORY - This also fixes bnc#701489.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 74756
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74756
    title openSUSE Security Update : postgresql (openSUSE-SU-2012:1173-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2012-2591.NASL
    description Update to latest Postgres releases --- resolves some security and data loss bugs http://www.postgresql.org/docs/9.1/static/release-9-1-3.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-24
    plugin id 58282
    published 2012-03-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58282
    title Fedora 16 : postgresql-9.1.3-1.fc16 (2012-2591)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2012-0678.NASL
    description Updated postgresql84 and postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command. This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation. (CVE-2012-0868) When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867) CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing. (CVE-2012-0866) These updated packages upgrade PostgreSQL to version 8.4.11, which fixes these issues as well as several data-corruption issues and lesser non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes : http://www.postgresql.org/docs/8.4/static/release.html All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 59214
    published 2012-05-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=59214
    title CentOS 5 / 6 : postgresql / postgresql84 (CESA-2012:0678)
redhat via4
advisories
  • bugzilla
    id 797917
    title CVE-2012-0868 postgresql: SQL injection due unsanitized newline characters in object names
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment postgresql is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677002
        • comment postgresql is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068003
      • AND
        • comment postgresql-contrib is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677010
        • comment postgresql-contrib is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068013
      • AND
        • comment postgresql-devel is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677014
        • comment postgresql-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068009
      • AND
        • comment postgresql-docs is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677020
        • comment postgresql-docs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068005
      • AND
        • comment postgresql-libs is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677018
        • comment postgresql-libs is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068011
      • AND
        • comment postgresql-pl is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677016
        • comment postgresql-pl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068017
      • AND
        • comment postgresql-python is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677004
        • comment postgresql-python is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068015
      • AND
        • comment postgresql-server is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677008
        • comment postgresql-server is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068019
      • AND
        • comment postgresql-tcl is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677006
        • comment postgresql-tcl is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068007
      • AND
        • comment postgresql-test is earlier than 0:8.1.23-4.el5_8
          oval oval:com.redhat.rhsa:tst:20120677012
        • comment postgresql-test is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070068021
    rhsa
    id RHSA-2012:0677
    released 2012-05-21
    severity Moderate
    title RHSA-2012:0677: postgresql security update (Moderate)
  • bugzilla
    id 797917
    title CVE-2012-0868 postgresql: SQL injection due unsanitized newline characters in object names
    oval
    OR
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhsa:tst:20100842001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhsa:tst:20100842002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20100842003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20100842004
      • OR
        • AND
          • comment postgresql is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678005
          • comment postgresql is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908006
        • AND
          • comment postgresql-contrib is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678009
          • comment postgresql-contrib is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908014
        • AND
          • comment postgresql-devel is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678011
          • comment postgresql-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908010
        • AND
          • comment postgresql-docs is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678013
          • comment postgresql-docs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908016
        • AND
          • comment postgresql-libs is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678015
          • comment postgresql-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908024
        • AND
          • comment postgresql-plperl is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678007
          • comment postgresql-plperl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908022
        • AND
          • comment postgresql-plpython is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678017
          • comment postgresql-plpython is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908018
        • AND
          • comment postgresql-pltcl is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678023
          • comment postgresql-pltcl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908020
        • AND
          • comment postgresql-server is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678019
          • comment postgresql-server is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908012
        • AND
          • comment postgresql-test is earlier than 0:8.4.11-1.el6_2
            oval oval:com.redhat.rhsa:tst:20120678021
          • comment postgresql-test is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100908008
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhsa:tst:20070055001
      • OR
        • AND
          • comment postgresql84 is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678026
          • comment postgresql84 is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430003
        • AND
          • comment postgresql84-contrib is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678038
          • comment postgresql84-contrib is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430023
        • AND
          • comment postgresql84-devel is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678032
          • comment postgresql84-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430017
        • AND
          • comment postgresql84-docs is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678040
          • comment postgresql84-docs is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430011
        • AND
          • comment postgresql84-libs is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678042
          • comment postgresql84-libs is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430013
        • AND
          • comment postgresql84-plperl is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678046
          • comment postgresql84-plperl is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430005
        • AND
          • comment postgresql84-plpython is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678030
          • comment postgresql84-plpython is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430019
        • AND
          • comment postgresql84-pltcl is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678048
          • comment postgresql84-pltcl is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430015
        • AND
          • comment postgresql84-python is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678036
          • comment postgresql84-python is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430025
        • AND
          • comment postgresql84-server is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678034
          • comment postgresql84-server is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430007
        • AND
          • comment postgresql84-tcl is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678044
          • comment postgresql84-tcl is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430009
        • AND
          • comment postgresql84-test is earlier than 0:8.4.11-1.el5_8
            oval oval:com.redhat.rhsa:tst:20120678028
          • comment postgresql84-test is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20100430021
    rhsa
    id RHSA-2012:0678
    released 2012-05-21
    severity Moderate
    title RHSA-2012:0678: postgresql and postgresql84 security update (Moderate)
rpms
  • postgresql-0:8.1.23-4.el5_8
  • postgresql-contrib-0:8.1.23-4.el5_8
  • postgresql-devel-0:8.1.23-4.el5_8
  • postgresql-docs-0:8.1.23-4.el5_8
  • postgresql-libs-0:8.1.23-4.el5_8
  • postgresql-pl-0:8.1.23-4.el5_8
  • postgresql-python-0:8.1.23-4.el5_8
  • postgresql-server-0:8.1.23-4.el5_8
  • postgresql-tcl-0:8.1.23-4.el5_8
  • postgresql-test-0:8.1.23-4.el5_8
  • postgresql-0:8.4.11-1.el6_2
  • postgresql-contrib-0:8.4.11-1.el6_2
  • postgresql-devel-0:8.4.11-1.el6_2
  • postgresql-docs-0:8.4.11-1.el6_2
  • postgresql-libs-0:8.4.11-1.el6_2
  • postgresql-plperl-0:8.4.11-1.el6_2
  • postgresql-plpython-0:8.4.11-1.el6_2
  • postgresql-pltcl-0:8.4.11-1.el6_2
  • postgresql-server-0:8.4.11-1.el6_2
  • postgresql-test-0:8.4.11-1.el6_2
  • postgresql84-0:8.4.11-1.el5_8
  • postgresql84-contrib-0:8.4.11-1.el5_8
  • postgresql84-devel-0:8.4.11-1.el5_8
  • postgresql84-docs-0:8.4.11-1.el5_8
  • postgresql84-libs-0:8.4.11-1.el5_8
  • postgresql84-plperl-0:8.4.11-1.el5_8
  • postgresql84-plpython-0:8.4.11-1.el5_8
  • postgresql84-pltcl-0:8.4.11-1.el5_8
  • postgresql84-python-0:8.4.11-1.el5_8
  • postgresql84-server-0:8.4.11-1.el5_8
  • postgresql84-tcl-0:8.4.11-1.el5_8
  • postgresql84-test-0:8.4.11-1.el5_8
refmap via4
confirm
debian DSA-2418
mandriva
  • MDVSA-2012:026
  • MDVSA-2012:027
secunia
  • 49272
  • 49273
suse openSUSE-SU-2012:1173
Last major update 07-12-2016 - 22:02
Published 18-07-2012 - 19:55
Back to Top