SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Database)  >   PostgreSQL Vendors:   postgresql.org
PostgreSQL Data Type Check Bypass and Table Column Modification Bugs Let Remote Users Deny Service
SecurityTracker Alert ID:  1017597
SecurityTracker URL:  http://securitytracker.com/id/1017597
CVE Reference:   CVE-2007-0555, CVE-2007-0556   (Links to External Site)
Date:  Feb 7 2007
Impact:   Denial of service via network, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.3, 7.4, 8.0, 8.1, 8.2
Description:   A vulnerability was reported in PostgreSQL. A remote authenticated user can cause denial of service conditions.

A remote authenticated user can send specially crafted data to suppress the normal SQL data type checks to cause the backend to crash [CVE-2007-0555].

A remote authenticated user can change the data type of a table column to cause a backend crash [CVE-2007-0556]. This may also be exploited to read portions of the database contents. Only versions 8.0, 8.1, and 8.2 are affected by this second vulnerability.

Impact:   A remote authenticated user can cause denial of service conditions on the target system.

A remote authenticated user may be able to read portions of the database contents.

Solution:   The vendor has issued fixed versions (7.3.13, 7.4.16, 8.0.11, 8.1.7, 8.2.2).
Vendor URL:  www.postgresql.org/support/security (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Feb 7 2007 (Red Hat Issues Fix) PostgreSQL Data Type Check Bypass and Table Column Modification Bugs Let Remote Users Deny Service
Red Hat has released a fix for Red Hat Enterprise Linux 3 and 4.
Feb 7 2007 (Red Hat Issues Fix for Red Hat Application Stack) PostgreSQL Data Type Check Bypass and Table Column Modification Bugs Let Remote Users Deny Service
Red Hat has released a fix for Red Hat Application Stack.
Feb 28 2007 (Sun Describes Workaround) PostgreSQL Data Type Check Bypass and Table Column Modification Bugs Let Remote Users Deny Service
Sun has described a workaround for one of the two vulnerabilities.
Mar 14 2007 (Red Hat Issues Fix) PostgreSQL Data Type Check Bypass and Table Column Modification Bugs Let Remote Users Deny Service
Red Hat has released a fix for Red Hat Enterprise Linux 5.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2016, SecurityGlobal.net LLC