PostgreSQL Data Type Check Bypass and Table Column Modification Bugs Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1017597
|
|
SecurityTracker URL: http://securitytracker.com/id?1017597
|
|
CVE Reference: CVE-2007-0555
, CVE-2007-0556
(Links to External Site)
|
Date: Feb 7 2007
|
Impact: Denial of service via network, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 7.3, 7.4, 8.0, 8.1, 8.2
|
Description: A vulnerability was reported in PostgreSQL. A remote authenticated user can cause denial of service conditions.
A remote authenticated user can send specially crafted data to suppress the normal SQL data type checks to cause the backend to crash
[CVE-2007-0555].
A remote authenticated user can change the data type of a table column to cause a backend crash [CVE-2007-0556].
This may also be exploited to read portions of the database contents. Only versions 8.0, 8.1, and 8.2 are affected by this second
vulnerability.
|
Impact: A remote authenticated user can cause denial of service conditions on the target system.
A remote authenticated user may be able to read portions of the database contents.
|
Solution: The vendor has issued fixed versions (7.3.13, 7.4.16, 8.0.11, 8.1.7, 8.2.2).
|
Vendor URL: www.postgresql.org/support/security (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 7 Feb 2007 15:21:30 -0500
Subject: PostgreSQL
|
CVE-2007-0555
Affected: 8.2, 8.1, 8.0, 7.4, 7.3
Fixed in: 8.2.2, 8.1.7, 8.0.11, 7.4.16, 7.3.13
A vulnerability allows suppressing the normal checks that a SQL function returns the
data type it's declared to do. These errors can easily be exploited to cause a backend
crash, and in principle might be used to read database content that the user should not
be able to access.
CVE-2007-0556
Affected: 8.2, 8.1, 8.0
Fixed in: 8.2.2, 8.1.7, 8.0.11
A vulnerability involving changing the data type of a table column can easily be
exploited to cause a backend crash, and in principle might be used to read database
content that the user should not be able to access.
|
|
