CERTA-2005-AVI-049
Vulnerability from certfr_avis - Published: 2005-02-09 - Updated: 2005-04-21None
Description
PostgreSQL est un outil de base de données Open Source.
Plusieurs vulnérabilités permettent à un utilisateur mal intentionné de
contourner les vérifications de sécurité ou d'exécuter du code
arbitraire, en local, avec les droits du serveur PostgreSQL.
Solution
Dans tous les cas, se référer au bulletin de sécurité de l'éditeur pour
l'obtention des correctifs (cf. section Documentation).
Mettre à jour PostgreSQL en versions 8.0.1, 7.4.7, 7.3.9 ou 7.2.7.
PostgreSQL est téléchargeable à l'adresse suivante :
http://wwwmaster.postgresql.org/download/mirror-ftp/
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| PostgreSQL | PostgreSQL | pour la branche 8.0.x, PostgreSQL versions 8.0.0 et antérieures. | ||
| PostgreSQL | PostgreSQL | pour la branche 7.3.x, PostgreSQL versions 7.3.8 et antérieures ; | ||
| PostgreSQL | PostgreSQL | Pour la branche 7.2.x, PostgreSQL versions 7.2.6 et antérieures ; | ||
| PostgreSQL | PostgreSQL | pour la branche 7.4.x, PostgreSQL versions 7.4.6 et antérieures ; |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "pour la branche 8.0.x, PostgreSQL versions 8.0.0 et ant\u00e9rieures.",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "pour la branche 7.3.x, PostgreSQL versions 7.3.8 et ant\u00e9rieures ;",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "Pour la branche 7.2.x, PostgreSQL versions 7.2.6 et ant\u00e9rieures ;",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "pour la branche 7.4.x, PostgreSQL versions 7.4.6 et ant\u00e9rieures ;",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nPostgreSQL est un outil de base de donn\u00e9es Open Source. \nPlusieurs vuln\u00e9rabilit\u00e9s permettent \u00e0 un utilisateur mal intentionn\u00e9 de\ncontourner les v\u00e9rifications de s\u00e9curit\u00e9 ou d\u0027ex\u00e9cuter du code\narbitraire, en local, avec les droits du serveur PostgreSQL.\n\n## Solution\n\nDans tous les cas, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour\nl\u0027obtention des correctifs (cf. section Documentation). \nMettre \u00e0 jour PostgreSQL en versions 8.0.1, 7.4.7, 7.3.9 ou 7.2.7. \nPostgreSQL est t\u00e9l\u00e9chargeable \u00e0 l\u0027adresse suivante :\n\n http://wwwmaster.postgresql.org/download/mirror-ftp/\n",
"cves": [],
"initial_release_date": "2005-02-09T00:00:00",
"last_revision_date": "2005-04-21T00:00:00",
"links": [
{
"title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Fedora Core 3 pour PostgreSQL :",
"url": "http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 FreeBSD pour ja-postgresql, postgresql, postgresql-server et postgresql-devel du 08 f\u00e9vrier 2005 :",
"url": "http://www.vuxml.org/freebsd/"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200502-19 du 14 f\u00e9vrier 2005 :",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200502-19.xml"
},
{
"title": "Annonce des nouvelles versions de PostgreSQL corrigeant la vuln\u00e9rabilit\u00e9 :",
"url": "http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2005:150 du 16 f\u00e9vrier 2005 :",
"url": "http://rhn.redhat.com/errata/RHSA-2005-150.html"
},
{
"title": "Mise \u00e0 jour de s\u00e9curit\u00e9 des paquetages NetBSD postgresql73, postgresql74 et postgresql80 :",
"url": "ftp://ftp.netbsd.org/pub/NetBSD/packages/pkgsrc/databases/postgresql74/README.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-683 du 15 f\u00e9vrier 2005 :",
"url": "http://www.debian.org/security/2005/dsa-683"
},
{
"title": "Site Internet de PostgreSQL :",
"url": "http://www.postgresql.org"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 FreeBSD pour ja-postgresql, postgresql et postgresql-server du 17 f\u00e9vrier 2005 :",
"url": "http://www.vuxml.org/freebsd/"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Mandrake MDKSA-2005:040 du 17 f\u00e9vrier 2005 :",
"url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:040"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200502-08 du 07 f\u00e9vrier 2005 :",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200502-08.xml"
},
{
"title": "Mise \u00e0 jour de s\u00e9curit\u00e9 des paquetages NetBSD postgresql73, postgresql74 et postgresql80 :",
"url": "ftp://ftp.netbsd.org/pub/NetBSD/packages/pkgsrc/databases/postgresql80/"
},
{
"title": "Mise \u00e0 jour de s\u00e9curit\u00e9 Fedora Core 2 pour PostgreSQL :",
"url": "http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 OpenBSD pour postgresql-server du 05 f\u00e9vrier 2005 :",
"url": "http://www.vuxml.org/openbsd/"
},
{
"title": "Annonce de la vuln\u00e9rabilit\u00e9 :",
"url": "http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php"
},
{
"title": "Mise \u00e0 jour de s\u00e9curit\u00e9 des paquetages NetBSD postgresql73, postgresql74 et postgresql80 :",
"url": "ftp://ftp.netbsd.org/pub/NetBSD/packages/pkgsrc/databases/postgresql73/README.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2005:141 du 14 f\u00e9vrier 2005 :",
"url": "http://rhn.redhat.com/errata/RHSA-2005-141.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2005:138 du 15 f\u00e9vrier 2005 :",
"url": "http://rhn.redhat.com/errata/RHSA-2005-138.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SA:2005:027 du 20 avril 2005 :",
"url": "http://www.novell.com/linux/security/advisories/2005_27_postgresql.html"
}
],
"reference": "CERTA-2005-AVI-049",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2005-02-09T00:00:00.000000"
},
{
"description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 RedHat RHSA-2005:141 et des r\u00e9f\u00e9rences CVE CAN-2005-244, CAN-2005-245, CAN-2005-246 et CAN-2005-247.",
"revision_date": "2005-02-14T00:00:00.000000"
},
{
"description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200502-19.",
"revision_date": "2005-02-15T00:00:00.000000"
},
{
"description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Debian DSA-683.",
"revision_date": "2005-02-16T00:00:00.000000"
},
{
"description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 RedHat RHSA-2005:150.",
"revision_date": "2005-02-17T00:00:00.000000"
},
{
"description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 RedHat RHSA-2005:138.",
"revision_date": "2005-02-18T00:00:00.000000"
},
{
"description": "ajout des r\u00e9f\u00e9rences aux mises \u00e0 jour de s\u00e9curit\u00e9 Fedora pour PostgreSQL.",
"revision_date": "2005-02-28T00:00:00.000000"
},
{
"description": "ajout r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 SuSE.",
"revision_date": "2005-04-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Ex\u00e9cution locale de code arbitraire avec les droits du serveur postgreSQL"
}
],
"summary": null,
"title": "Vuln\u00e9rabilit\u00e9 de PostgreSQL",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Debian DSA-668",
"url": "http://www.debian.org/security/2005/dsa-668"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…