National Vulnerability Database (NVD) National Vulnerability Database (CVE-2009-3230)

National Cyber Awareness System

Vulnerability Summary for CVE-2009-3230

Original release date:09/17/2009

Last revised:08/21/2010

Source: US-CERT/NIST

Overview

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:6.5 (MEDIUM) (AV:N/AC:L/Au:S/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 8.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Required to exploit

Impact Type:Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2009-9474

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html

External Source: FEDORA

Name: FEDORA-2009-9473

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=522085

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=522085

External Source: VUPEN

Name: ADV-2009-2602

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/2602

External Source: DEBIAN

Name: DSA-1900

Hyperlink:http://www.us.debian.org/security/2009/dsa-1900

External Source: UBUNTU

Name: USN-834-1

Hyperlink:http://www.ubuntu.com/usn/usn-834-1

External Source: BID

Name: 36314

Hyperlink:http://www.securityfocus.com/bid/36314

External Source: BUGTRAQ

Name: 20100307 rPSA-2010-0012-1 postgresql postgresql-contrib postgresql-server

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/509917/100/0/threaded

External Source: CONFIRM

Name: http://www.postgresql.org/support/security.html

Type: Advisory

Hyperlink:http://www.postgresql.org/support/security.html

External Source: CONFIRM

Name: http://www.postgresql.org/docs/8.3/static/release-8-3-8.html

Type: Advisory

Hyperlink:http://www.postgresql.org/docs/8.3/static/release-8-3-8.html

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012

External Source: SUNALERT

Name: 270408

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1

External Source: SECUNIA

Name: 36837

Hyperlink:http://secunia.com/advisories/36837

External Source: SECUNIA

Name: 36800

Hyperlink:http://secunia.com/advisories/36800

External Source: SECUNIA

Name: 36727

Type: Advisory

Hyperlink:http://secunia.com/advisories/36727

External Source: SECUNIA

Name: 36695

Type: Advisory

Hyperlink:http://secunia.com/advisories/36695

External Source: SECUNIA

Name: 36660

Type: Advisory

Hyperlink:http://secunia.com/advisories/36660

External Source: OVAL

Name: oval:org.mitre.oval:def:10166

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10166

External Source: SUSE

Name: SUSE-SR:2009:017

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html

External Source: SUSE

Name: SUSE-SR:2009:016

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

External Source: MLIST

Name: [pgsql-www] 20090909 Re: Incorrect CVE reference on security page

Hyperlink:http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php

References to Check Content

Identifier:oval:org.mitre.oval:def:10166

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10166

Vulnerable software and versions

Configuration 1

* cpe:/a:postgresql:postgresql:8.4

* cpe:/a:postgresql:postgresql:8.3.6

* cpe:/a:postgresql:postgresql:8.3.1

* cpe:/a:postgresql:postgresql:8.3.2

* cpe:/a:postgresql:postgresql:8.3.3

* cpe:/a:postgresql:postgresql:8.3.4

* cpe:/a:postgresql:postgresql:8.3.5

* cpe:/a:postgresql:postgresql:8.3.7

* cpe:/a:postgresql:postgresql:8.2

* cpe:/a:postgresql:postgresql:8.2.1

* cpe:/a:postgresql:postgresql:8.2.2

* cpe:/a:postgresql:postgresql:8.2.3

* cpe:/a:postgresql:postgresql:8.2.4

* cpe:/a:postgresql:postgresql:8.2.5

* cpe:/a:postgresql:postgresql:8.2.6

* cpe:/a:postgresql:postgresql:8.2.7

* cpe:/a:postgresql:postgresql:8.2.8

* cpe:/a:postgresql:postgresql:8.2.9

* cpe:/a:postgresql:postgresql:8.2.10

* cpe:/a:postgresql:postgresql:8.2.13

* cpe:/a:postgresql:postgresql:8.2.12

* cpe:/a:postgresql:postgresql:8.2.11

* cpe:/a:postgresql:postgresql:8.1

* cpe:/a:postgresql:postgresql:8.1.1

* cpe:/a:postgresql:postgresql:8.1.2

* cpe:/a:postgresql:postgresql:8.1.3

* cpe:/a:postgresql:postgresql:8.1.4

* cpe:/a:postgresql:postgresql:8.1.5

* cpe:/a:postgresql:postgresql:8.1.6

* cpe:/a:postgresql:postgresql:8.1.7

* cpe:/a:postgresql:postgresql:8.1.8

* cpe:/a:postgresql:postgresql:8.1.9

* cpe:/a:postgresql:postgresql:8.1.10

* cpe:/a:postgresql:postgresql:8.1.11

* cpe:/a:postgresql:postgresql:8.1.12

* cpe:/a:postgresql:postgresql:8.1.13

* cpe:/a:postgresql:postgresql:8.1.14

* cpe:/a:postgresql:postgresql:8.1.15

* cpe:/a:postgresql:postgresql:8.1.16

* cpe:/a:postgresql:postgresql:8.0

* cpe:/a:postgresql:postgresql:8.0.1

* cpe:/a:postgresql:postgresql:8.0.2

* cpe:/a:postgresql:postgresql:8.0.3

* cpe:/a:postgresql:postgresql:8.0.4

* cpe:/a:postgresql:postgresql:8.0.5

* cpe:/a:postgresql:postgresql:8.0.6

* cpe:/a:postgresql:postgresql:8.0.7

* cpe:/a:postgresql:postgresql:8.0.8

* cpe:/a:postgresql:postgresql:8.0.9

* cpe:/a:postgresql:postgresql:8.0.10

* cpe:/a:postgresql:postgresql:8.0.11

* cpe:/a:postgresql:postgresql:8.0.12

* cpe:/a:postgresql:postgresql:8.0.13

* cpe:/a:postgresql:postgresql:8.0.14

* cpe:/a:postgresql:postgresql:8.0.15

* cpe:/a:postgresql:postgresql:8.0.16

* cpe:/a:postgresql:postgresql:8.0.17

* cpe:/a:postgresql:postgresql:8.0.18

* cpe:/a:postgresql:postgresql:8.0.19

* cpe:/a:postgresql:postgresql:8.0.20

* cpe:/a:postgresql:postgresql:8.0.21

* cpe:/a:postgresql:postgresql:7.4

* cpe:/a:postgresql:postgresql:7.4.1

* cpe:/a:postgresql:postgresql:7.4.10

* cpe:/a:postgresql:postgresql:7.4.11

* cpe:/a:postgresql:postgresql:7.4.12

* cpe:/a:postgresql:postgresql:7.4.13

* cpe:/a:postgresql:postgresql:7.4.14

* cpe:/a:postgresql:postgresql:7.4.15

* cpe:/a:postgresql:postgresql:7.4.16

* cpe:/a:postgresql:postgresql:7.4.17

* cpe:/a:postgresql:postgresql:7.4.18

* cpe:/a:postgresql:postgresql:7.4.2

* cpe:/a:postgresql:postgresql:7.4.24

* cpe:/a:postgresql:postgresql:7.4.3

* cpe:/a:postgresql:postgresql:7.4.4

* cpe:/a:postgresql:postgresql:7.4.5

* cpe:/a:postgresql:postgresql:7.4.6

* cpe:/a:postgresql:postgresql:7.4.7

* cpe:/a:postgresql:postgresql:7.4.8

* cpe:/a:postgresql:postgresql:7.4.19

* cpe:/a:postgresql:postgresql:7.4.20

* cpe:/a:postgresql:postgresql:7.4.21

* cpe:/a:postgresql:postgresql:7.4.22

* cpe:/a:postgresql:postgresql:7.4.23

* cpe:/a:postgresql:postgresql:7.4.25

* cpe:/a:postgresql:postgresql:7.4.9

* Denotes Vulnerable Software

Technical Details

Vulnerability Type (View All)

Permissions, Privileges, and Access Control (CWE-264)

CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3230