ID CVE-2016-5424
Summary PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.
References
Vulnerable Configurations
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • PostgreSQL 9.5.3
    cpe:2.3:a:postgresql:postgresql:9.5.3
  • PostgreSQL 9.5.2
    cpe:2.3:a:postgresql:postgresql:9.5.2
  • cpe:2.3:a:postgresql:postgresql:9.5.1
    cpe:2.3:a:postgresql:postgresql:9.5.1
  • PostgreSQL PostgreSQL 9.5
    cpe:2.3:a:postgresql:postgresql:9.5
  • PostgreSQL 9.4.8
    cpe:2.3:a:postgresql:postgresql:9.4.8
  • PostgreSQL 9.4.7
    cpe:2.3:a:postgresql:postgresql:9.4.7
  • PostgreSQL 9.4.6
    cpe:2.3:a:postgresql:postgresql:9.4.6
  • PostgreSQL PostgreSQL 9.4.5
    cpe:2.3:a:postgresql:postgresql:9.4.5
  • cpe:2.3:a:postgresql:postgresql:9.4.4
    cpe:2.3:a:postgresql:postgresql:9.4.4
  • cpe:2.3:a:postgresql:postgresql:9.4.3
    cpe:2.3:a:postgresql:postgresql:9.4.3
  • cpe:2.3:a:postgresql:postgresql:9.4.2
    cpe:2.3:a:postgresql:postgresql:9.4.2
  • cpe:2.3:a:postgresql:postgresql:9.4.1
    cpe:2.3:a:postgresql:postgresql:9.4.1
  • PostgreSQL PostgreSQL 9.4
    cpe:2.3:a:postgresql:postgresql:9.4
  • PostgreSQL 9.3.13
    cpe:2.3:a:postgresql:postgresql:9.3.13
  • PostgreSQL 9.3.12
    cpe:2.3:a:postgresql:postgresql:9.3.12
  • PostgreSQL 9.3.11
    cpe:2.3:a:postgresql:postgresql:9.3.11
  • PostgreSQL 9.3.10
    cpe:2.3:a:postgresql:postgresql:9.3.10
  • cpe:2.3:a:postgresql:postgresql:9.3.9
    cpe:2.3:a:postgresql:postgresql:9.3.9
  • cpe:2.3:a:postgresql:postgresql:9.3.8
    cpe:2.3:a:postgresql:postgresql:9.3.8
  • cpe:2.3:a:postgresql:postgresql:9.3.7
    cpe:2.3:a:postgresql:postgresql:9.3.7
  • cpe:2.3:a:postgresql:postgresql:9.3.6
    cpe:2.3:a:postgresql:postgresql:9.3.6
  • cpe:2.3:a:postgresql:postgresql:9.3.5
    cpe:2.3:a:postgresql:postgresql:9.3.5
  • cpe:2.3:a:postgresql:postgresql:9.3.4
    cpe:2.3:a:postgresql:postgresql:9.3.4
  • PostgreSQL PostgreSQL 9.3
    cpe:2.3:a:postgresql:postgresql:9.3
  • PostgreSQL PostgreSQL 9.3.1
    cpe:2.3:a:postgresql:postgresql:9.3.1
  • PostgreSQL PostgreSQL 9.3.2
    cpe:2.3:a:postgresql:postgresql:9.3.2
  • PostgreSQL PostgreSQL 9.3.3
    cpe:2.3:a:postgresql:postgresql:9.3.3
  • PostgreSQL 9.2.16
    cpe:2.3:a:postgresql:postgresql:9.2.16
  • PostgreSQL 9.2.15
    cpe:2.3:a:postgresql:postgresql:9.2.15
  • PostgreSQL PostgreSQL 9.2.14
    cpe:2.3:a:postgresql:postgresql:9.2.14
  • cpe:2.3:a:postgresql:postgresql:9.2.13
    cpe:2.3:a:postgresql:postgresql:9.2.13
  • cpe:2.3:a:postgresql:postgresql:9.2.12
    cpe:2.3:a:postgresql:postgresql:9.2.12
  • cpe:2.3:a:postgresql:postgresql:9.2.11
    cpe:2.3:a:postgresql:postgresql:9.2.11
  • cpe:2.3:a:postgresql:postgresql:9.2.10
    cpe:2.3:a:postgresql:postgresql:9.2.10
  • cpe:2.3:a:postgresql:postgresql:9.2.9
    cpe:2.3:a:postgresql:postgresql:9.2.9
  • cpe:2.3:a:postgresql:postgresql:9.2.8
    cpe:2.3:a:postgresql:postgresql:9.2.8
  • PostgreSQL 9.2
    cpe:2.3:a:postgresql:postgresql:9.2
  • PostgreSQL 9.2.1
    cpe:2.3:a:postgresql:postgresql:9.2.1
  • PostgreSQL 9.2.2
    cpe:2.3:a:postgresql:postgresql:9.2.2
  • PostgreSQL PostgreSQL 9.2.3
    cpe:2.3:a:postgresql:postgresql:9.2.3
  • PostgreSQL PostgreSQL 9.2.4
    cpe:2.3:a:postgresql:postgresql:9.2.4
  • PostgreSQL PostgreSQL 9.2.5
    cpe:2.3:a:postgresql:postgresql:9.2.5
  • PostgreSQL PostgreSQL 9.2.6
    cpe:2.3:a:postgresql:postgresql:9.2.6
  • PostgreSQL PostgreSQL 9.2.7
    cpe:2.3:a:postgresql:postgresql:9.2.7
  • PostgreSQL 9.2.17
    cpe:2.3:a:postgresql:postgresql:9.2.17
  • PostgreSQL 9.1.22
    cpe:2.3:a:postgresql:postgresql:9.1.22
CVSS
Base: 4.6 (as of 14-12-2016 - 12:25)
Impact:
Exploitability:
CWE CWE-94
CAPEC
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Access
VectorComplexityAuthentication
NETWORK HIGH SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_414C18BF365311E795506CC21735F730.NASL
    description The PostgreSQL project reports : Security Fixes nested CASE expressions + database and role names with embedded special characters - CVE-2017-7484: selectivity estimators bypass SELECT privilege checks. - CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable - CVE-2017-7486: pg_user_mappings view discloses foreign server passwords. This applies to new databases, see the release notes for the procedure to apply the fix to an existing database.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 100141
    published 2017-05-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100141
    title FreeBSD : PostgreSQL vulnerabilities (414c18bf-3653-11e7-9550-6cc21735f730)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20161103_POSTGRESQL_ON_SL7_X.NASL
    description The following packages have been upgraded to a newer upstream version: postgresql (9.2.18). Security Fix(es) : - A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423) - A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424) Additional Changes :
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 95856
    published 2016-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95856
    title Scientific Linux Security Update : postgresql on SL7.x x86_64
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-472.NASL
    description This update for postgresql93 to version 9.3.14 fixes the several issues. These security issues were fixed : - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). This non-security issue was fixed : - bsc#973660: Added 'Requires: timezone' to Service Pack - bsc#1029547: postgresql: fails to build with timezone 2017a For additional non-security issues please refer to - http://www.postgresql.org/docs/9.3/static/release-9-3-14.html - http://www.postgresql.org/docs/9.3/static/release-9-3-13.html - http://www.postgresql.org/docs/9.4/static/release-9-3-12.html This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 99417
    published 2017-04-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99417
    title openSUSE Security Update : postgresql93 (openSUSE-2017-472)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-3646.NASL
    description Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. - CVE-2016-5423 Karthikeyan Jambu Rajaraman discovered that nested CASE-WHEN expressions are not properly evaluated, potentially leading to a crash or allowing to disclose portions of server memory. - CVE-2016-5424 Nathan Bossart discovered that special characters in database and role names are not properly handled, potentially leading to the execution of commands with superuser privileges, when a superuser executes pg_dumpall or other routine maintenance operations.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 92875
    published 2016-08-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92875
    title Debian DSA-3646-1 : postgresql-9.4 - security update
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2016-1058.NASL
    description According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code.(CVE-2016-5423) - A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program.(CVE-2016-5424) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 99820
    published 2017-05-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99820
    title EulerOS 2.0 SP1 : postgresql (EulerOS-SA-2016-1058)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2016-2606.NASL
    description An update for postgresql is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a newer upstream version: postgresql (9.2.18). Security Fix(es) : * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423) * A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Heikki Linnakangas as the original reporter of CVE-2016-5423; and Nathan Bossart as the original reporter of CVE-2016-5424. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 94569
    published 2016-11-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94569
    title RHEL 7 : postgresql (RHSA-2016:2606)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3066-1.NASL
    description Heikki Linnakangas discovered that PostgreSQL incorrectly handled certain nested CASE/WHEN expressions. A remote attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. (CVE-2016-5423) Nathan Bossart discovered that PostgreSQL incorrectly handled special characters in database and role names. A remote attacker could possibly use this issue to escalate privileges. (CVE-2016-5424). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93047
    published 2016-08-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93047
    title Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : postgresql-9.1, postgresql-9.3, postgresql-9.5 vulnerabilities (USN-3066-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2016-2606.NASL
    description An update for postgresql is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a newer upstream version: postgresql (9.2.18). Security Fix(es) : * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423) * A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Heikki Linnakangas as the original reporter of CVE-2016-5423; and Nathan Bossart as the original reporter of CVE-2016-5424. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 95352
    published 2016-11-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=95352
    title CentOS 7 : postgresql (CESA-2016:2606)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1161.NASL
    description This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed : - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). This non-security issue was fixed : - bsc#973660: Added 'Requires: timezone' to Service Pack For additional non-security issues please refer to - http://www.postgresql.org/docs/9.4/static/release-9-4-9.html - http://www.postgresql.org/docs/9.4/static/release-9-4-8.html - http://www.postgresql.org/docs/9.4/static/release-9-4-7.html This update was imported from the SUSE:SLE-12:Update update project.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93997
    published 2016-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93997
    title openSUSE Security Update : postgresql94 (openSUSE-2016-1161)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2415-1.NASL
    description This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed : - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). This non-security issue was fixed : - bsc#973660: Added 'Requires: timezone' to Service Pack For additional non-security issues please refer to - http://www.postgresql.org/docs/9.4/static/release-9-4-9.html - http://www.postgresql.org/docs/9.4/static/release-9-4-8.html - http://www.postgresql.org/docs/9.4/static/release-9-4-7.html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93807
    published 2016-09-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93807
    title SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2016:2415-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2418-1.NASL
    description This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed : - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). For the non-security issues please refer to - http://www.postgresql.org/docs/9.4/static/release-9-4-9.html - http://www.postgresql.org/docs/9.4/static/release-9-4-8.html - http://www.postgresql.org/docs/9.4/static/release-9-4-7.html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93808
    published 2016-09-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93808
    title SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2016:2418-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2016-1140.NASL
    description The postgresql server postgresql93 was updated to 9.3.14 fixes the following issues : Update to version 9.3.14 : - Fix possible mis-evaluation of nested CASE-WHEN expressions (CVE-2016-5423, boo#993454) - Fix client programs' handling of special characters in database and role names (CVE-2016-5424, boo#993453) - Fix corner-case misbehaviors for IS NULL/IS NOT NULL applied to nested composite values - Make the inet and cidr data types properly reject IPv6 addresses with too many colon-separated fields - Prevent crash in close_ps() (the point ## lseg operator) for NaN input coordinates - Fix several one-byte buffer over-reads in to_number() - Avoid unsafe intermediate state during expensive paths through heap_update() - For the other bug fixes, see the release notes: https://www.postgresql.org/docs/9.3/static/release-9-3-1 4.html Update to version 9.3.13 : This update fixes several problems which caused downtime for users, including : - Clearing the OpenSSL error queue before OpenSSL calls, preventing errors in SSL connections, particularly when using the Python, Ruby or PHP OpenSSL wrappers - Fixed the 'failed to build N-way joins' planner error - Fixed incorrect handling of equivalence in multilevel nestloop query plans, which could emit rows which didn't match the WHERE clause. - Prevented two memory leaks with using GIN indexes, including a potential index corruption risk. The release also includes many other bug fixes for reported issues, many of which affect all supported versions : - Fix corner-case parser failures occurring when operator_precedence_warning is turned on - Prevent possible misbehavior of TH, th, and Y,YYY format codes in to_timestamp() - Correct dumping of VIEWs and RULEs which use ANY (array) in a subselect - Disallow newlines in ALTER SYSTEM parameter values - Avoid possible misbehavior after failing to remove a tablespace symlink - Fix crash in logical decoding on alignment-picky platforms - Avoid repeated requests for feedback from receiver while shutting down walsender - Multiple fixes for pg_upgrade - Support building with Visual Studio 2015 - This update also contains tzdata release 2016d, with updates for Russia, Venezuela, Kirov, and Tomsk. http://www.postgresql.org/docs/current/static/release-9- 3-13.html Update to version 9.3.12 : - Fix two bugs in indexed ROW() comparisons - Avoid data loss due to renaming files - Prevent an error in rechecking rows in SELECT FOR UPDATE/SHARE - Fix bugs in multiple json_ and jsonb_ functions - Log lock waits for INSERT ON CONFLICT correctly - Ignore recovery_min_apply_delay until reaching a consistent state - Fix issue with pg_subtrans XID wraparound - Fix assorted bugs in Logical Decoding - Fix planner error with nested security barrier views - Prevent memory leak in GIN indexes - Fix two issues with ispell dictionaries - Avoid a crash on old Windows versions - Skip creating an erroneous delete script in pg_upgrade - Correctly translate empty arrays into PL/Perl - Make PL/Python cope with identifier names For the full release notes, see: http://www.postgresql.org/docs/9.4/static/release-9-3-12.html
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93825
    published 2016-10-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93825
    title openSUSE Security Update : postgresql93 (openSUSE-2016-1140)
  • NASL family Databases
    NASL id POSTGRESQL_20160811.NASL
    description The version of PostgreSQL installed on the remote host is 9.1.x prior to 9.1.23, 9.2.x prior to 9.2.18, 9.3.x prior to 9.3.14, 9.4.x prior to 9.4.9, or 9.5.x prior to 9.5.4. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists that allows an authenticated, remote attacker to crash the database via specially crafted nested CASE expressions. (CVE-2016-5423) - A flaw exists that is triggered during the handling of database and role names with embedded special characters. An unauthenticated, remote attacker can exploit this to execute arbitrary code during administrative operations such as pg_dumpall. (CVE-2016-5424) - A denial of service vulnerability exists in the pg_get_expr() function that is triggered during the handling of inconsistent values. An authenticated, remote attacker can exploit this to crash the database. (VulnDB 143018) - An overflow condition exists in the to_number() function due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this to cause a denial of service condition. (VulnDB 143019)
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93050
    published 2016-08-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93050
    title PostgreSQL 9.1.x < 9.1.23 / 9.2.x < 9.2.18 / 9.3.x < 9.3.14 / 9.4.x < 9.4.9 / 9.5.x < 9.5.4 Multiple Vulnerabilities
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_CA16FD0B5FD111E6A6F26CC21735F730.NASL
    description PostgreSQL project reports : Security Fixes nested CASE expressions + database and role names with embedded special characters - CVE-2016-5423: certain nested CASE expressions can cause the server to crash. - CVE-2016-5424: database and role names with embedded special characters can allow code injection during administrative operations like pg_dumpall.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 92929
    published 2016-08-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=92929
    title FreeBSD : PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities (ca16fd0b-5fd1-11e6-a6f2-6cc21735f730)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-5486A6DFC0.NASL
    description Update to version 9.4.9 per release notes, includes security fixes for CVE-2016-5423 and CVE-2016-5424 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93087
    published 2016-08-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93087
    title Fedora 23 : postgresql (2016-5486a6dfc0)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-30B01BDEDD.NASL
    description Update to version 9.5.4 per release notes, includes security fixes for CVE-2016-5423 and CVE-2016-5424 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93085
    published 2016-08-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93085
    title Fedora 24 : postgresql (2016-30b01bdedd)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2016-747.NASL
    description A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423) A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424)
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93539
    published 2016-09-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93539
    title Amazon Linux AMI : postgresql92 / postgresql93,postgresql94 (ALAS-2016-747)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2016-2414-1.NASL
    description This update for postgresql93 to version 9.3.14 fixes the several issues. These security issues were fixed : - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference (bsc#993454). - CVE-2016-5424: Fix client programs' handling of special characters in database and role names (bsc#993453). This non-security issue was fixed : - bsc#973660: Added 'Requires: timezone' to Service Pack For additional non-security issues please refer to - http://www.postgresql.org/docs/9.3/static/release-9-3-14.html - http://www.postgresql.org/docs/9.3/static/release-9-3-13.html - http://www.postgresql.org/docs/9.4/static/release-9-3-12.html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 93806
    published 2016-09-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=93806
    title SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2016:2414-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2016-2606.NASL
    description From Red Hat Security Advisory 2016:2606 : An update for postgresql is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a newer upstream version: postgresql (9.2.18). Security Fix(es) : * A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423) * A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Heikki Linnakangas as the original reporter of CVE-2016-5423; and Nathan Bossart as the original reporter of CVE-2016-5424. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 94725
    published 2016-11-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94725
    title Oracle Linux 7 : postgresql (ELSA-2016-2606)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201701-33.NASL
    description The remote host is affected by the vulnerability described in GLSA-201701-33 (PostgreSQL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or escalate privileges. Workaround : There is no known workaround at this time.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 96474
    published 2017-01-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=96474
    title GLSA-201701-33 : PostgreSQL: Multiple vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2016-765BB26915.NASL
    description Update to version 9.5.4 per release notes, includes security fixes for CVE-2016-5423 and CVE-2016-5424 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2017-10-29
    modified 2017-05-19
    plugin id 94820
    published 2016-11-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=94820
    title Fedora 25 : postgresql (2016-765bb26915)
redhat via4
advisories
bugzilla
id 1364002
title CVE-2016-5424 postgresql: privilege escalation via crafted database and role names
oval
AND
  • OR
    • comment Red Hat Enterprise Linux 7 Client is installed
      oval oval:com.redhat.rhsa:tst:20140675001
    • comment Red Hat Enterprise Linux 7 Server is installed
      oval oval:com.redhat.rhsa:tst:20140675002
    • comment Red Hat Enterprise Linux 7 Workstation is installed
      oval oval:com.redhat.rhsa:tst:20140675003
    • comment Red Hat Enterprise Linux 7 ComputeNode is installed
      oval oval:com.redhat.rhsa:tst:20140675004
  • OR
    • AND
      • comment postgresql is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606013
      • comment postgresql is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908006
    • AND
      • comment postgresql-contrib is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606007
      • comment postgresql-contrib is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908014
    • AND
      • comment postgresql-devel is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606017
      • comment postgresql-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908010
    • AND
      • comment postgresql-docs is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606023
      • comment postgresql-docs is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908016
    • AND
      • comment postgresql-libs is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606011
      • comment postgresql-libs is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908024
    • AND
      • comment postgresql-plperl is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606019
      • comment postgresql-plperl is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908022
    • AND
      • comment postgresql-plpython is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606005
      • comment postgresql-plpython is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908018
    • AND
      • comment postgresql-pltcl is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606021
      • comment postgresql-pltcl is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908020
    • AND
      • comment postgresql-server is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606025
      • comment postgresql-server is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908012
    • AND
      • comment postgresql-test is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606015
      • comment postgresql-test is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100908008
    • AND
      • comment postgresql-upgrade is earlier than 0:9.2.18-1.el7
        oval oval:com.redhat.rhsa:tst:20162606009
      • comment postgresql-upgrade is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20150750037
rhsa
id RHSA-2016:2606
released 2016-11-03
severity Moderate
title RHSA-2016:2606: postgresql security and bug fix update (Moderate)
rpms
  • postgresql-0:9.2.18-1.el7
  • postgresql-contrib-0:9.2.18-1.el7
  • postgresql-devel-0:9.2.18-1.el7
  • postgresql-docs-0:9.2.18-1.el7
  • postgresql-libs-0:9.2.18-1.el7
  • postgresql-plperl-0:9.2.18-1.el7
  • postgresql-plpython-0:9.2.18-1.el7
  • postgresql-pltcl-0:9.2.18-1.el7
  • postgresql-server-0:9.2.18-1.el7
  • postgresql-test-0:9.2.18-1.el7
  • postgresql-upgrade-0:9.2.18-1.el7
refmap via4
bid 92435
confirm
debian DSA-3646
gentoo GLSA-201701-33
sectrack 1036617
Last major update 14-12-2016 - 12:59
Published 09-12-2016 - 18:59
Last modified 30-06-2017 - 21:29
Back to Top