ID CVE-2015-3165
Summary Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
References
Vulnerable Configurations
  • Canonical Ubuntu Linux 12.04 LTS
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:-:-:lts
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Canonical Ubuntu Linux 14.10
    cpe:2.3:o:canonical:ubuntu_linux:14.10
  • Canonical Ubuntu Linux 15.04
    cpe:2.3:o:canonical:ubuntu_linux:15.04
  • Debian Linux 7.0
    cpe:2.3:o:debian:debian_linux:7.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Apple Mac OS X Server 5.0.2
    cpe:2.3:o:apple:mac_os_x_server:5.0.2
  • cpe:2.3:a:postgresql:postgresql:9.0.19
    cpe:2.3:a:postgresql:postgresql:9.0.19
  • PostgreSQL 9.1
    cpe:2.3:a:postgresql:postgresql:9.1
  • PostgreSQL 9.1.1
    cpe:2.3:a:postgresql:postgresql:9.1.1
  • PostgreSQL 9.1.2
    cpe:2.3:a:postgresql:postgresql:9.1.2
  • PostgreSQL 9.1.3
    cpe:2.3:a:postgresql:postgresql:9.1.3
  • PostgreSQL 9.1.4
    cpe:2.3:a:postgresql:postgresql:9.1.4
  • PostgreSQL 9.1.5
    cpe:2.3:a:postgresql:postgresql:9.1.5
  • PostgreSQL 9.1.6
    cpe:2.3:a:postgresql:postgresql:9.1.6
  • PostgreSQL 9.1.7
    cpe:2.3:a:postgresql:postgresql:9.1.7
  • PostgreSQL 9.1.8
    cpe:2.3:a:postgresql:postgresql:9.1.8
  • PostgreSQL PostgreSQL 9.1.9
    cpe:2.3:a:postgresql:postgresql:9.1.9
  • PostgreSQL PostgreSQL 9.1.10
    cpe:2.3:a:postgresql:postgresql:9.1.10
  • PostgreSQL PostgreSQL 9.1.11
    cpe:2.3:a:postgresql:postgresql:9.1.11
  • PostgreSQL PostgreSQL 9.1.12
    cpe:2.3:a:postgresql:postgresql:9.1.12
  • cpe:2.3:a:postgresql:postgresql:9.1.13
    cpe:2.3:a:postgresql:postgresql:9.1.13
  • cpe:2.3:a:postgresql:postgresql:9.1.14
    cpe:2.3:a:postgresql:postgresql:9.1.14
  • cpe:2.3:a:postgresql:postgresql:9.1.15
    cpe:2.3:a:postgresql:postgresql:9.1.15
  • PostgreSQL 9.2
    cpe:2.3:a:postgresql:postgresql:9.2
  • PostgreSQL 9.2.1
    cpe:2.3:a:postgresql:postgresql:9.2.1
  • PostgreSQL 9.2.2
    cpe:2.3:a:postgresql:postgresql:9.2.2
  • PostgreSQL PostgreSQL 9.2.3
    cpe:2.3:a:postgresql:postgresql:9.2.3
  • PostgreSQL PostgreSQL 9.2.4
    cpe:2.3:a:postgresql:postgresql:9.2.4
  • PostgreSQL PostgreSQL 9.2.5
    cpe:2.3:a:postgresql:postgresql:9.2.5
  • PostgreSQL PostgreSQL 9.2.6
    cpe:2.3:a:postgresql:postgresql:9.2.6
  • PostgreSQL PostgreSQL 9.2.7
    cpe:2.3:a:postgresql:postgresql:9.2.7
  • cpe:2.3:a:postgresql:postgresql:9.2.8
    cpe:2.3:a:postgresql:postgresql:9.2.8
  • cpe:2.3:a:postgresql:postgresql:9.2.9
    cpe:2.3:a:postgresql:postgresql:9.2.9
  • cpe:2.3:a:postgresql:postgresql:9.2.10
    cpe:2.3:a:postgresql:postgresql:9.2.10
  • PostgreSQL PostgreSQL 9.3
    cpe:2.3:a:postgresql:postgresql:9.3
  • PostgreSQL PostgreSQL 9.3.1
    cpe:2.3:a:postgresql:postgresql:9.3.1
  • PostgreSQL PostgreSQL 9.3.2
    cpe:2.3:a:postgresql:postgresql:9.3.2
  • PostgreSQL PostgreSQL 9.3.3
    cpe:2.3:a:postgresql:postgresql:9.3.3
  • PostgreSQL 9.3.4
    cpe:2.3:a:postgresql:postgresql:9.3.4
  • PostgreSQL 9.3.5
    cpe:2.3:a:postgresql:postgresql:9.3.5
  • PostgreSQL 9.3.6
    cpe:2.3:a:postgresql:postgresql:9.3.6
  • PostgreSQL 9.4.0
    cpe:2.3:a:postgresql:postgresql:9.4.0
  • PostgreSQL 9.4.1
    cpe:2.3:a:postgresql:postgresql:9.4.1
CVSS
Base: 4.3 (as of 30-08-2016 - 11:17)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-227.NASL
    description Several vulnerabilities were discovered in PostgreSQL, a relational database server system. The 8.4 branch is EOLed upstream, but still present in Debian squeeze. This new LTS minor version contains the fixes that were applied upstream to the 9.0.20 version, backported to 8.4.22 which was the last version officially released by the PostgreSQL developers. This LTS effort for squeeze-lts is a community project sponsored by credativ GmbH. CVE-2015-3165: Remote crash SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. CVE-2015-3166: Information exposure The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. CVE-2015-3167: Possible side-channel key exposure In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message. Note that the next round of minor releases for PostgreSQL have already been scheduled for early June 2015. There will be a corresponding 8.4.22lts3 update at the same time. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 83905
    published 2015-06-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83905
    title Debian DLA-227-1 : postgresql-8.4 update
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_FC38CD8300B311E58EBD0026551A22DC.NASL
    description PostgreSQL project reports : This update fixes three security vulnerabilities reported in PostgreSQL over the past few months. Nether of these issues is seen as particularly urgent. However, users should examine them in case their installations are vulnerable:. - CVE-2015-3165 Double 'free' after authentication timeout. - CVE-2015-3166 Unanticipated errors from the standard library. - CVE-2015-3167 pgcrypto has multiple error messages for decryption with an incorrect key.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 83799
    published 2015-05-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83799
    title FreeBSD : PostgreSQL -- minor security problems. (fc38cd83-00b3-11e5-8ebd-0026551a22dc)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20150629_POSTGRESQL_ON_SL6_X.NASL
    description A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 84540
    published 2015-07-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84540
    title Scientific Linux Security Update : postgresql on SL6.x, SL7.x i386/x86_64
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3270.NASL
    description Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. - CVE-2015-3165 (Remote crash) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. - CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. - CVE-2015-3167 (Possible side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 83787
    published 2015-05-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83787
    title Debian DSA-3270-1 : postgresql-9.4 - security update
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2621-1.NASL
    description Benkocs Norbert Attila discovered that PostgreSQL incorrectly handled authentication timeouts. A remote attacker could use this flaw to cause the unauthenticated session to crash, possibly leading to a security issue. (CVE-2015-3165) Noah Misch discovered that PostgreSQL incorrectly handled certain standard library function return values, possibly leading to security issues. (CVE-2015-3166) Noah Misch discovered that the pgcrypto function could return different error messages when decrypting using an incorrect key, possibly leading to a security issue. (CVE-2015-3167). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 83862
    published 2015-05-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83862
    title Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : postgresql-9.1, postgresql-9.3, postgresql-9.4 vulnerabilities (USN-2621-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201507-20.NASL
    description The remote host is affected by the vulnerability described in GLSA-201507-20 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition or escalate privileges. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2017-01-03
    plugin id 84863
    published 2015-07-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84863
    title GLSA-201507-20 : PostgreSQL: Multiple vulnerabilities
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2015-546.NASL
    description Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 84247
    published 2015-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84247
    title Amazon Linux AMI : postgresql93 (ALAS-2015-546)
  • NASL family CGI abuses
    NASL id PUPPET_ENTERPRISE_ACTIVEMQ_PSQL_SSL.NASL
    description According to its self-reported version number, the Puppet Enterprise application running on the remote host is 3.x prior to 3.8.1. It is, therefore, affected by the following vulnerabilities : - An XML external entity injection (XXE) flaw exists in the Apache ActiveMQ component due to a faulty configuration that allows an XML parser to accept XML external entities from untrusted sources. A remote attacker, by sending crafted XML data, can exploit this to disclose arbitrary files. (CVE-2014-3600) - An authentication bypass vulnerability exists in the Apache ActiveMQ component due to a flaw in the LDAPLoginModule implementation. A remote attacker can exploit this to bypass authentication mechanisms. (CVE-2014-3612) - Multiple cross-site scripting vulnerabilities exist in the administrative console of Apache ActiveMQ that allow a remote attacker to inject arbitrary HTML or web scripts. (CVE-2014-8110) - An invalid free memory error exists due to improper validation of user-supplied input when a DTLS peer receives application data between ChangeCipherSpec and Finished messages. A remote attacker can exploit this to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2014-8176) - A denial of service vulnerability exists when processing an ECParameters structure due to an infinite loop that occurs when a specified curve is over a malformed binary polynomial field. A remote attacker can exploit this to perform a denial of service against any system that processes public keys, certificate requests, or certificates. This includes TLS clients and TLS servers with client authentication enabled. (CVE-2015-1788) - A denial of service vulnerability exists due to improper validation of the content and length of the ASN1_TIME string by the X509_cmp_time() function. A remote attacker can exploit this, via a malformed certificate and CRLs of various sizes, to cause a segmentation fault, resulting in a denial of service condition. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks. (CVE-2015-1789) - A NULL pointer dereference flaw exists in the PKCS#7 parsing code due to incorrect handling of missing inner 'EncryptedContent'. This allows a remote attacker, via specially crafted ASN.1-encoded PKCS#7 blobs with missing content, to cause a denial of service condition or other potential unspecified impacts. (CVE-2015-1790) - A double-free error exists due to a race condition that occurs when a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket. (CVE-2015-1791) - A denial of service vulnerability exists in the CMS code due to an infinite loop that occurs when verifying a signedData message. A remote attacker can exploit this to cause a denial of service condition. (CVE-2015-1792) - A double-free memory flaw exists in PostgreSQL due to a timeout interrupt occurring partway in the session shutdown sequence. A remote attacker, by closing an SSL session when the authentication timeout expires, can exploit this flaw to cause a denial of service. (CVE-2015-3165) - An out-of-memory condition exists in the printf() functions in PostgreSQL due to a failure to check for errors. A remote attacker can exploit this to access sensitive information. (CVE-2015-3166) - A flaw exists in contrib/pgcrypto in PostgreSQL due to cases of decryption reporting other error message texts, which a remote attacker can use to recover keys from other systems. (CVE-2015-3167) - A man-in-the-middle vulnerability, known as Logjam, exists due to a flaw in the SSL/TLS protocol. A remote attacker can exploit this flaw to downgrade connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. (CVE-2015-4000)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 84960
    published 2015-07-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84960
    title Puppet Enterprise 3.x < 3.8.1 Multiple Vulnerabilities (Logjam)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2015-545.NASL
    description Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a denial of service (crash) by closing an SSL session at a time when the authentication timeout will expire during the session shutdown sequence.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 84246
    published 2015-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84246
    title Amazon Linux AMI : postgresql92 (ALAS-2015-545)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-1091-1.NASL
    description This update provides PostgreSQL 9.1.18, which brings fixes for security issues and other enhancements. The following vulnerabilities have been fixed : CVE-2015-3165: Avoid possible crash when client disconnects. (bsc#931972) CVE-2015-3166: Consistently check for failure of the *printf(). (bsc#931973) CVE-2015-3167: In contrib/pgcrypto, uniformly report decryption failures. (bsc#931974) For a comprehensive list of changes, please refer to h ttp://www.postgresql.org/docs/9.1/static/release-9-1-18.html. This update also includes changes in PostgreSQL's packaging to prepare for the migration to the new major version 9.4. (FATE#316970, bsc#907651) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 84338
    published 2015-06-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84338
    title SUSE SLED11 / SLES11 Security Update : postgresql91 (SUSE-SU-2015:1091-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2015-1194.NASL
    description From Red Hat Security Advisory 2015:1194 : Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 84464
    published 2015-06-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84464
    title Oracle Linux 6 / 7 : postgresql (ELSA-2015-1194)
  • NASL family Databases
    NASL id POSTGRESQL_20150522.NASL
    description The version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.20, 9.1.x prior to 9.1.16, 9.2.x prior to 9.2.11, 9.3.x prior to 9.3.7, or 9.4.x prior to 9.4.2. It is, therefore, affected by multiple vulnerabilities : - A double free memory error exists after authentication timeout, which a remote attacker can utilize to cause the program to crash. (CVE-2015-3165) - A flaw exists in the printf() functions due to a failure to check for errors. A remote attacker can use this to gain access to sensitive information. (CVE-2015-3166) - pgcrypto has multiple error messages for decryption with an incorrect key. A remote attacker can use this to recover keys from other systems. (CVE-2015-3167)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 83818
    published 2015-05-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83818
    title PostgreSQL 9.0 < 9.0.20 / 9.1 < 9.1.16 / 9.2 < 9.2.11 / 9.3 < 9.3.7 / 9.4 < 9.4.2 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3269.NASL
    description Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. - CVE-2015-3165 (Remote crash) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. - CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls; the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. - CVE-2015-3167 (Possible side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 83786
    published 2015-05-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83786
    title Debian DSA-3269-1 : postgresql-9.1 - security update
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2015-1194.NASL
    description Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 84466
    published 2015-06-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84466
    title RHEL 6 / 7 : postgresql (RHSA-2015:1194)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2015-1264-1.NASL
    description PostgreSQL was updated to the security and bugfix release 9.3.8 including 9.3.7. Security issues fixed : - CVE-2015-3165, bsc#931972: Avoid possible crash when client disconnects just before the authentication timeout expires. - CVE-2015-3166, bsc#931973: Consistently check for failure of the printf() family of functions. - CVE-2015-3167, bsc#931974: In contrib/pgcrypto, uniformly report decryption failures as 'Wrong key or corrupt data' Bugs fixed : - Protect against wraparound of multixact member IDs. - Avoid failures while fsync'ing data directory during crash restart. - Fix pg_get_functiondef() to show functions' LEAKPROOF property, if set. - Allow libpq to use TLS protocol versions beyond v1. - For the full release notes, see the following two URLs http://www.postgresql.org/docs/9.3/static/release-9-3-8. html http://www.postgresql.org/docs/9.3/static/release-9-3-7. html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-18
    plugin id 84896
    published 2015-07-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84896
    title SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:1264-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2015-1194.NASL
    description Updated postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Benkocs Norbert Attila as the original reporter of CVE-2015-3165 and Noah Misch as the original reporter of CVE-2015-3166 and CVE-2015-3167. All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 84446
    published 2015-06-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84446
    title CentOS 6 / 7 : postgresql (CESA-2015:1194)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2015-556.NASL
    description A double-free flaw was found in the connection handling. An unauthenticated attacker could exploit this flaw to crash the PostgreSQL back end by disconnecting at approximately the same time as the authentication time out is triggered. (CVE-2015-3165) It was discovered that PostgreSQL did not properly check the return values of certain standard library functions. If the system is in a state that would cause the standard library functions to fail, for example memory exhaustion, an authenticated user could exploit this flaw to disclose partial memory contents or cause the GSSAPI authentication to use an incorrect keytab file. (CVE-2015-3166) It was discovered that the pgcrypto module could return different error messages when decrypting certain data with an incorrect key. This can help an authenticated user to launch a possible cryptographic attack, although no suitable attack is currently known. (CVE-2015-3167)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 84592
    published 2015-07-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=84592
    title Amazon Linux AMI : postgresql8 (ALAS-2015-556)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SERVER_5_0_3.NASL
    description The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the mod_headers module that allows HTTP trailers to replace HTTP headers late during request processing. A remote attacker can exploit this to inject arbitrary headers. This can also cause some modules to function incorrectly or appear to function incorrectly. (CVE-2013-5704) - A privilege escalation vulnerability exists due to the 'make check' command not properly invoking initdb to specify authentication requirements for a database cluster to be used for tests. A local attacker can exploit this issue to gain temporary server access and elevated privileges. (CVE-2014-0067) - A NULL pointer dereference flaw exists in module mod_cache. A remote attacker, using an empty HTTP Content-Type header, can exploit this vulnerability to crash a caching forward proxy configuration, resulting in a denial of service if using a threaded MPM. (CVE-2014-3581) - A out-of-bounds memory read flaw exists in module mod_proxy_fcgi. An attacker, using a remote FastCGI server to send long response headers, can exploit this vulnerability to cause a denial of service by causing a buffer over-read. (CVE-2014-3583) - A flaw exists in module mod_lua when handling a LuaAuthzProvider used in multiple Require directives with different arguments. An attacker can exploit this vulnerability to bypass intended access restrictions. (CVE-2014-8109) - An information disclosure vulnerability exists due to improper handling of restricted column values in constraint-violation error messages. An authenticated, remote attacker can exploit this to gain access to sensitive information. (CVE-2014-8161) - A flaw exists within the Domain Name Service due to an error in the code used to follow delegations. A remote attacker, with a maliciously-constructed zone or query, can cause the service to issue unlimited queries, resulting in resource exhaustion. (CVE-2014-8500) - A flaw exists in the lua_websocket_read() function in the 'mod_lua' module due to incorrect handling of WebSocket PING frames. A remote attacker can exploit this, by sending a crafted WebSocket PING frame after a Lua script has called the wsupgrade() function, to crash a child process, resulting in a denial of service condition. (CVE-2015-0228) - Multiple vulnerabilities exist due to several buffer overflow errors related to the 'to_char' functions. An authenticated, remote attacker can exploit these issues to cause a denial of service or arbitrary code execution. (CVE-2015-0241) - Multiple vulnerabilities exist due to several stack-based buffer overflow errors in various *printf() functions. The overflows are due to improper validation of user-supplied input when formatting a floating point number where the requested precision is greater than approximately 500. An authenticated, remote attacker can exploit these issues to cause a denial of service or arbitrary code execution. (CVE-2015-0242) - Multiple vulnerabilities exist due to an overflow condition in multiple functions in the 'pgcrypto' extension. The overflows are due to improper validation of user-supplied input when tracking memory sizes. An authenticated, remote attacker can exploit these issues to cause a denial of service or arbitrary code execution. (CVE-2015-0243) - A SQL injection vulnerability exists due to improper sanitization of user-supplied input when handling crafted binary data within a command parameter. An authenticated, remote attacker can exploit this issue to inject or manipulate SQL queries, allowing the manipulation or disclosure of arbitrary data. (CVE-2015-0244) - A NULL pointer dereference flaw exists in the read_request_line() function due to a failure to initialize the protocol structure member. A remote attacker can exploit this flaw, on installations that enable the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI, by sending a request that lacks a method, to cause a denial of service condition. (CVE-2015-0253) - A denial of service vulnerability exists due to an error relating to DNSSEC validation and the managed-keys feature. A remote attacker can trigger an incorrect trust-anchor management scenario in which no key is ready for use, resulting in an assertion failure and daemon crash. (CVE-2015-1349) - A flaw exists in PostgreSQL client disconnect timeout expiration that is triggered when a timeout interrupt is fired partway through the session shutdown sequence. (CVE-2015-3165) - A flaw exists in the printf() functions due to a failure to check for errors. A remote attacker can use this to gain access to sensitive information. (CVE-2015-3166) - The pgcrypto component in PostgreSQL has multiple error messages for decryption with an incorrect key. A remote attacker can use this to recover keys from other systems. (CVE-2015-3167) - A flaw exists in the chunked transfer coding implementation due to a failure to properly parse chunk headers. A remote attacker can exploit this to conduct HTTP request smuggling attacks. (CVE-2015-3183) - A flaw exists in the ap_some_auth_required() function due to a failure to consider that a Require directive may be associated with an authorization setting rather than an authentication setting. A remote attacker can exploit this, if a module that relies on the 2.2 API behavior exists, to bypass intended access restrictions. (CVE-2015-3185) - Multiple unspecified XML flaws exist in the Wiki Server based on Twisted. (CVE-2015-5911)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 86066
    published 2015-09-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=86066
    title Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities
redhat via4
advisories
  • rhsa
    id RHSA-2015:1194
  • rhsa
    id RHSA-2015:1195
  • rhsa
    id RHSA-2015:1196
rpms
  • postgresql-0:8.4.20-3.el6_6
  • postgresql-contrib-0:8.4.20-3.el6_6
  • postgresql-devel-0:8.4.20-3.el6_6
  • postgresql-docs-0:8.4.20-3.el6_6
  • postgresql-libs-0:8.4.20-3.el6_6
  • postgresql-plperl-0:8.4.20-3.el6_6
  • postgresql-plpython-0:8.4.20-3.el6_6
  • postgresql-pltcl-0:8.4.20-3.el6_6
  • postgresql-server-0:8.4.20-3.el6_6
  • postgresql-test-0:8.4.20-3.el6_6
  • postgresql-0:9.2.13-1.el7_1
  • postgresql-contrib-0:9.2.13-1.el7_1
  • postgresql-devel-0:9.2.13-1.el7_1
  • postgresql-docs-0:9.2.13-1.el7_1
  • postgresql-libs-0:9.2.13-1.el7_1
  • postgresql-plperl-0:9.2.13-1.el7_1
  • postgresql-plpython-0:9.2.13-1.el7_1
  • postgresql-pltcl-0:9.2.13-1.el7_1
  • postgresql-server-0:9.2.13-1.el7_1
  • postgresql-test-0:9.2.13-1.el7_1
  • postgresql-upgrade-0:9.2.13-1.el7_1
refmap via4
apple APPLE-SA-2015-09-16-4
bid 74787
confirm
debian
  • DSA-3269
  • DSA-3270
gentoo GLSA-201507-20
ubuntu USN-2621-1
Last major update 30-08-2016 - 11:21
Published 28-05-2015 - 10:59
Last modified 04-01-2018 - 21:30
Back to Top