ID CVE-2007-6601
Summary The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.
References
Vulnerable Configurations
  • cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.8:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.8:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.9:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.9:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.10:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.10:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.11:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.11:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.12:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.12:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.13:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.13:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.14:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.14:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.15:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.15:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.16:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.16:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.17:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.17:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.18:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.18:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.19:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.19:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.3.20:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.3.20:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.15:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.15:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.18:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.18:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.1.10:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.1.10:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.2.5:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*
CVSS
Base: 7.2 (as of 18-01-2023 - 21:19)
Impact:
Exploitability:
CWE CWE-287
CAPEC
  • Man in the Middle Attack
    This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never observed. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components. MITM attacks differ from sniffing attacks since they often modify the communications prior to delivering it to the intended recipient. These attacks also differ from interception attacks since they may forward the sender's original unmodified data, after copying it, instead of keeping it for themselves.
  • Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
    This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated. Rest applications premise is that they leverage existing infrastructure to deliver web services functionality. An example of this is a Rest application that uses HTTP Get methods and receives a HTTP response with an XML document. These Rest style web services are deployed on existing infrastructure such as Apache and IIS web servers with no SOAP stack required. Unfortunately from a security standpoint, there frequently is no interoperable identity security mechanism deployed, so Rest developers often fall back to SSL to deliver security. In large data centers, SSL is typically terminated at the edge of the network - at the firewall, load balancer, or router. Once the SSL is terminated the HTTP request is in the clear (unless developers have hashed or encrypted the values, but this is rare). The attacker can utilize a sniffer such as Wireshark to snapshot the credentials, such as username and password that are passed in the clear once SSL is terminated. Once the attacker gathers these credentials, they can submit requests to the web service provider just as authorized user do. There is not typically an authentication on the client side, beyond what is passed in the request itself so once this is compromised, then this is generally sufficient to compromise the service's authentication scheme.
  • Session Hijacking
    This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The advarsary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
  • Fake the Source of Data
    An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
  • Authentication Abuse
    An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.
  • Identity Spoofing
    Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an adversary may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the apparent identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the apparent identity of the message but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content.
  • Token Impersonation
    An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
  • Authentication Bypass
    An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place. This refers to an attacker gaining access equivalent to an authenticated user without ever going through an authentication procedure. This is usually the result of the attacker using an unexpected access procedure that does not go through the proper checkpoints where authentication should occur. For example, a web site might assume that all users will click through a given link in order to get to secure material and simply authenticate everyone that clicks the link. However, an attacker might be able to reach secured web content by explicitly entering the path to the content rather than clicking through the authentication link, thereby avoiding the check entirely. This attack pattern differs from other authentication attacks in that attacks of this pattern avoid authentication entirely, rather than faking authentication by exploiting flaws or by stealing credentials from legitimate users.
  • Exploiting Trust in Client
    An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Upload a Web Shell to a Web Server
    By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:C/I:C/A:C
oval via4
accepted 2013-04-29T04:11:41.689-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.
family unix
id oval:org.mitre.oval:def:11127
status accepted
submitted 2010-07-09T03:56:16-04:00
title The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.
version 30
redhat via4
advisories
  • bugzilla
    id 427128
    title CVE-2007-6601 PostgreSQL privilege escalation via dblink
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304025
      • OR
        • AND
          • comment postgresql is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038001
          • comment postgresql is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526002
        • AND
          • comment postgresql-contrib is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038003
          • comment postgresql-contrib is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526004
        • AND
          • comment postgresql-devel is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038005
          • comment postgresql-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526006
        • AND
          • comment postgresql-docs is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038007
          • comment postgresql-docs is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526008
        • AND
          • comment postgresql-jdbc is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038009
          • comment postgresql-jdbc is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526010
        • AND
          • comment postgresql-libs is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038011
          • comment postgresql-libs is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526012
        • AND
          • comment postgresql-pl is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038013
          • comment postgresql-pl is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526014
        • AND
          • comment postgresql-python is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038015
          • comment postgresql-python is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526016
        • AND
          • comment postgresql-server is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038017
          • comment postgresql-server is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526018
        • AND
          • comment postgresql-tcl is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038019
          • comment postgresql-tcl is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526020
        • AND
          • comment postgresql-test is earlier than 0:7.4.19-1.el4_6.1
            oval oval:com.redhat.rhsa:tst:20080038021
          • comment postgresql-test is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20060526022
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331005
      • OR
        • AND
          • comment postgresql is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038024
          • comment postgresql is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068002
        • AND
          • comment postgresql-contrib is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038026
          • comment postgresql-contrib is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068004
        • AND
          • comment postgresql-devel is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038028
          • comment postgresql-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068006
        • AND
          • comment postgresql-docs is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038030
          • comment postgresql-docs is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068008
        • AND
          • comment postgresql-libs is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038032
          • comment postgresql-libs is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068010
        • AND
          • comment postgresql-pl is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038034
          • comment postgresql-pl is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068012
        • AND
          • comment postgresql-python is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038036
          • comment postgresql-python is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068014
        • AND
          • comment postgresql-server is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038038
          • comment postgresql-server is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068016
        • AND
          • comment postgresql-tcl is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038040
          • comment postgresql-tcl is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068018
        • AND
          • comment postgresql-test is earlier than 0:8.1.11-1.el5_1.1
            oval oval:com.redhat.rhsa:tst:20080038042
          • comment postgresql-test is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070068020
    rhsa
    id RHSA-2008:0038
    released 2008-01-11
    severity Moderate
    title RHSA-2008:0038: postgresql security update (Moderate)
  • rhsa
    id RHSA-2008:0039
  • rhsa
    id RHSA-2008:0040
rpms
  • postgresql-0:7.4.19-1.el4_6.1
  • postgresql-0:8.1.11-1.el5_1.1
  • postgresql-contrib-0:7.4.19-1.el4_6.1
  • postgresql-contrib-0:8.1.11-1.el5_1.1
  • postgresql-debuginfo-0:7.4.19-1.el4_6.1
  • postgresql-debuginfo-0:8.1.11-1.el5_1.1
  • postgresql-devel-0:7.4.19-1.el4_6.1
  • postgresql-devel-0:8.1.11-1.el5_1.1
  • postgresql-docs-0:7.4.19-1.el4_6.1
  • postgresql-docs-0:8.1.11-1.el5_1.1
  • postgresql-jdbc-0:7.4.19-1.el4_6.1
  • postgresql-libs-0:7.4.19-1.el4_6.1
  • postgresql-libs-0:8.1.11-1.el5_1.1
  • postgresql-pl-0:7.4.19-1.el4_6.1
  • postgresql-pl-0:8.1.11-1.el5_1.1
  • postgresql-python-0:7.4.19-1.el4_6.1
  • postgresql-python-0:8.1.11-1.el5_1.1
  • postgresql-server-0:7.4.19-1.el4_6.1
  • postgresql-server-0:8.1.11-1.el5_1.1
  • postgresql-tcl-0:7.4.19-1.el4_6.1
  • postgresql-tcl-0:8.1.11-1.el5_1.1
  • postgresql-test-0:7.4.19-1.el4_6.1
  • postgresql-test-0:8.1.11-1.el5_1.1
  • rh-postgresql-0:7.3.21-1
  • rh-postgresql-contrib-0:7.3.21-1
  • rh-postgresql-debuginfo-0:7.3.21-1
  • rh-postgresql-devel-0:7.3.21-1
  • rh-postgresql-docs-0:7.3.21-1
  • rh-postgresql-jdbc-0:7.3.21-1
  • rh-postgresql-libs-0:7.3.21-1
  • rh-postgresql-pl-0:7.3.21-1
  • rh-postgresql-python-0:7.3.21-1
  • rh-postgresql-server-0:7.3.21-1
  • rh-postgresql-tcl-0:7.3.21-1
  • rh-postgresql-test-0:7.3.21-1
  • postgresql-0:8.1.11-1.el4s1.1
  • postgresql-0:8.2.6-1.el5s2
  • postgresql-contrib-0:8.1.11-1.el4s1.1
  • postgresql-contrib-0:8.2.6-1.el5s2
  • postgresql-debuginfo-0:8.1.11-1.el4s1.1
  • postgresql-debuginfo-0:8.2.6-1.el5s2
  • postgresql-devel-0:8.1.11-1.el4s1.1
  • postgresql-devel-0:8.2.6-1.el5s2
  • postgresql-docs-0:8.1.11-1.el4s1.1
  • postgresql-docs-0:8.2.6-1.el5s2
  • postgresql-libs-0:8.1.11-1.el4s1.1
  • postgresql-libs-0:8.2.6-1.el5s2
  • postgresql-pl-0:8.1.11-1.el4s1.1
  • postgresql-plperl-0:8.2.6-1.el5s2
  • postgresql-plpython-0:8.2.6-1.el5s2
  • postgresql-pltcl-0:8.2.6-1.el5s2
  • postgresql-python-0:8.1.11-1.el4s1.1
  • postgresql-python-0:8.2.6-1.el5s2
  • postgresql-server-0:8.1.11-1.el4s1.1
  • postgresql-server-0:8.2.6-1.el5s2
  • postgresql-tcl-0:8.1.11-1.el4s1.1
  • postgresql-tcl-0:8.2.6-1.el5s2
  • postgresql-test-0:8.1.11-1.el4s1.1
  • postgresql-test-0:8.2.6-1.el5s2
refmap via4
bid 27163
bugtraq
  • 20080107 PostgreSQL 2007-01-07 Cumulative Security Release
  • 20080115 rPSA-2008-0016-1 postgresql postgresql-server
confirm
debian
  • DSA-1460
  • DSA-1463
fedora
  • FEDORA-2008-0478
  • FEDORA-2008-0552
gentoo GLSA-200801-15
hp
  • HPSBTU02325
  • SSRT080006
mandriva MDVSA-2008:004
sectrack 1019157
secunia
  • 28359
  • 28376
  • 28437
  • 28438
  • 28445
  • 28454
  • 28455
  • 28464
  • 28477
  • 28479
  • 28679
  • 28698
  • 29638
sunalert
  • 103197
  • 200559
suse SUSE-SA:2008:005
ubuntu USN-568-1
vupen
  • ADV-2008-0061
  • ADV-2008-0109
  • ADV-2008-1071
xf postgresql-dblink-privilege-escalation(39500)
Last major update 18-01-2023 - 21:19
Published 09-01-2008 - 21:46
Last modified 18-01-2023 - 21:19
Back to Top