The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Postgresql | Postgresql | 7.4 (including) | 7.4 (including) |
| Postgresql | Postgresql | 7.4.1 (including) | 7.4.1 (including) |
| Postgresql | Postgresql | 7.4.2 (including) | 7.4.2 (including) |
| Postgresql | Postgresql | 7.4.3 (including) | 7.4.3 (including) |
| Postgresql | Postgresql | 7.4.4 (including) | 7.4.4 (including) |
| Postgresql | Postgresql | 7.4.5 (including) | 7.4.5 (including) |
| Postgresql | Postgresql | 7.4.6 (including) | 7.4.6 (including) |
| Postgresql | Postgresql | 7.4.7 (including) | 7.4.7 (including) |
| Postgresql | Postgresql | 7.4.8 (including) | 7.4.8 (including) |
| Postgresql | Postgresql | 7.4.9 (including) | 7.4.9 (including) |
| Postgresql | Postgresql | 7.4.10 (including) | 7.4.10 (including) |
| Postgresql | Postgresql | 7.4.11 (including) | 7.4.11 (including) |
| Postgresql | Postgresql | 7.4.12 (including) | 7.4.12 (including) |
| Postgresql | Postgresql | 7.4.13 (including) | 7.4.13 (including) |
| Postgresql | Postgresql | 7.4.14 (including) | 7.4.14 (including) |
| Postgresql | Postgresql | 7.4.15 (including) | 7.4.15 (including) |
| Postgresql | Postgresql | 7.4.16 (including) | 7.4.16 (including) |
| Postgresql | Postgresql | 7.4.17 (including) | 7.4.17 (including) |
| Postgresql | Postgresql | 7.4.18 (including) | 7.4.18 (including) |
| Postgresql | Postgresql | 7.4.19 (including) | 7.4.19 (including) |
| Postgresql | Postgresql | 7.4.20 (including) | 7.4.20 (including) |
| Postgresql | Postgresql | 7.4.21 (including) | 7.4.21 (including) |
| Postgresql | Postgresql | 7.4.22 (including) | 7.4.22 (including) |
| Postgresql | Postgresql | 7.4.23 (including) | 7.4.23 (including) |
| Postgresql | Postgresql | 7.4.24 (including) | 7.4.24 (including) |
| Postgresql | Postgresql | 7.4.25 (including) | 7.4.25 (including) |
| Postgresql | Postgresql | 7.4.26 (including) | 7.4.26 (including) |
| Postgresql | Postgresql | 7.4.27 (including) | 7.4.27 (including) |
| Postgresql | Postgresql | 7.4.28 (including) | 7.4.28 (including) |
| Postgresql | Postgresql | 7.4.29 (including) | 7.4.29 (including) |
| Red Hat Enterprise Linux 4 | RedHat | postgresql-0:7.4.30-1.el4_8.1 | * |
| Red Hat Enterprise Linux 5 | RedHat | postgresql-0:8.1.22-1.el5_5.1 | * |
| Red Hat Enterprise Linux 5 | RedHat | postgresql84-0:8.4.5-1.el5_5.1 | * |
| Red Hat Enterprise Linux 6 | RedHat | postgresql-0:8.4.5-1.el6_0.2 | * |
| Postgresql-7.4 | Ubuntu | dapper | * |
| Postgresql-8.0 | Ubuntu | dapper | * |
| Postgresql-8.1 | Ubuntu | dapper | * |
| Postgresql-8.1 | Ubuntu | upstream | * |
| Postgresql-8.2 | Ubuntu | hardy | * |
| Postgresql-8.3 | Ubuntu | hardy | * |
| Postgresql-8.3 | Ubuntu | jaunty | * |
| Postgresql-8.3 | Ubuntu | karmic | * |
| Postgresql-8.3 | Ubuntu | upstream | * |
| Postgresql-8.4 | Ubuntu | devel | * |
| Postgresql-8.4 | Ubuntu | karmic | * |
| Postgresql-8.4 | Ubuntu | lucid | * |
| Postgresql-8.4 | Ubuntu | maverick | * |
| Postgresql-8.4 | Ubuntu | natty | * |
| Postgresql-8.4 | Ubuntu | oneiric | * |
| Postgresql-8.4 | Ubuntu | upstream | * |
References
- http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049591.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049592.html
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html
- http://marc.info/?l=bugtraq\u0026m=134124585221119\u0026w=2
- http://secunia.com/advisories/42325
- http://www.debian.org/security/2010/dsa-2120
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:197
- http://www.postgresql.org/about/news.1244
- http://www.postgresql.org/docs/9.0/static/release-9-0-1.html
- http://www.redhat.com/support/errata/RHSA-2010-0742.html
- http://www.redhat.com/support/errata/RHSA-2010-0908.html
- http://www.securityfocus.com/bid/43747
- http://www.ubuntu.com/usn/USN-1002-1
- http://www.ubuntu.com/usn/USN-1002-2
- http://www.vupen.com/english/advisories/2010/3051
- https://bugzilla.redhat.com/show_bug.cgi?id=639371
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7291
- http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049591.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049592.html
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html
- http://marc.info/?l=bugtraq\u0026m=134124585221119\u0026w=2
- http://secunia.com/advisories/42325
- http://www.debian.org/security/2010/dsa-2120
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:197
- http://www.postgresql.org/about/news.1244
- http://www.postgresql.org/docs/9.0/static/release-9-0-1.html
- http://www.redhat.com/support/errata/RHSA-2010-0742.html
- http://www.redhat.com/support/errata/RHSA-2010-0908.html
- http://www.securityfocus.com/bid/43747
- http://www.ubuntu.com/usn/USN-1002-1
- http://www.ubuntu.com/usn/USN-1002-2
- http://www.vupen.com/english/advisories/2010/3051
- https://bugzilla.redhat.com/show_bug.cgi?id=639371
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7291