National Cyber Awareness System

Vulnerability Summary for CVE-2010-1170

Overview

The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads Tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary Tcl code by creating this table and inserting a crafted Tcl script.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2010-1167

Type: Advisory; Patch Information

Hyperlink:http://www.vupen.com/english/advisories/2010/1167

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=583072

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=583072

External Source: VUPEN

Name: ADV-2010-1221

Hyperlink:http://www.vupen.com/english/advisories/2010/1221

External Source: VUPEN

Name: ADV-2010-1207

Hyperlink:http://www.vupen.com/english/advisories/2010/1207

External Source: VUPEN

Name: ADV-2010-1198

Hyperlink:http://www.vupen.com/english/advisories/2010/1198

External Source: VUPEN

Name: ADV-2010-1197

Hyperlink:http://www.vupen.com/english/advisories/2010/1197

External Source: VUPEN

Name: ADV-2010-1182

Hyperlink:http://www.vupen.com/english/advisories/2010/1182

External Source: SECTRACK

Name: 1023987

Hyperlink:http://www.securitytracker.com/id?1023987

External Source: BID

Name: 40215

Hyperlink:http://www.securityfocus.com/bid/40215

External Source: REDHAT

Name: RHSA-2010:0430

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0430.html

External Source: REDHAT

Name: RHSA-2010:0429

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0429.html

External Source: REDHAT

Name: RHSA-2010:0428

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0428.html

External Source: REDHAT

Name: RHSA-2010:0427

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0427.html

External Source: CONFIRM

Name: http://www.postgresql.org/support/security

Hyperlink:http://www.postgresql.org/support/security

External Source: CONFIRM

Name: http://www.postgresql.org/docs/current/static/release-8-4-4.html

Hyperlink:http://www.postgresql.org/docs/current/static/release-8-4-4.html

External Source: CONFIRM

Name: http://www.postgresql.org/docs/current/static/release-8-3-11.html

Hyperlink:http://www.postgresql.org/docs/current/static/release-8-3-11.html

External Source: CONFIRM

Name: http://www.postgresql.org/docs/current/static/release-8-2-17.html

Hyperlink:http://www.postgresql.org/docs/current/static/release-8-2-17.html

External Source: CONFIRM

Name: http://www.postgresql.org/docs/current/static/release-8-1-21.html

Hyperlink:http://www.postgresql.org/docs/current/static/release-8-1-21.html

External Source: CONFIRM

Name: http://www.postgresql.org/docs/current/static/release-8-0-25.html

Hyperlink:http://www.postgresql.org/docs/current/static/release-8-0-25.html

External Source: CONFIRM

Name: http://www.postgresql.org/docs/current/static/release-7-4-29.html

Hyperlink:http://www.postgresql.org/docs/current/static/release-7-4-29.html

External Source: CONFIRM

Name: http://www.postgresql.org/about/news.1203

Type: Advisory

Hyperlink:http://www.postgresql.org/about/news.1203

External Source: MLIST

Name: [oss-security] 20100520 CVE-2010-1974 reject request (dupe of CVE-2010-1168) and CVE-2010-1447 description modification request

Hyperlink:http://www.openwall.com/lists/oss-security/2010/05/20/5

External Source: MANDRIVA

Name: MDVSA-2010:103

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:103

External Source: DEBIAN

Name: DSA-2051

Hyperlink:http://www.debian.org/security/2010/dsa-2051

External Source: SECUNIA

Name: 39939

Hyperlink:http://secunia.com/advisories/39939

External Source: SECUNIA

Name: 39898

Hyperlink:http://secunia.com/advisories/39898

External Source: SECUNIA

Name: 39845

Type: Advisory

Hyperlink:http://secunia.com/advisories/39845

External Source: SECUNIA

Name: 39820

Hyperlink:http://secunia.com/advisories/39820

External Source: SECUNIA

Name: 39815

Hyperlink:http://secunia.com/advisories/39815

External Source: OVAL

Name: oval:org.mitre.oval:def:10510

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10510

External Source: OSVDB

Name: 64757

Hyperlink:http://osvdb.org/64757

External Source: SUSE

Name: SUSE-SR:2010:014

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html

External Source: FEDORA

Name: FEDORA-2010-8723

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041591.html

External Source: FEDORA

Name: FEDORA-2010-8715

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041579.html

External Source: FEDORA

Name: FEDORA-2010-8696

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041559.html

References to Check Content

Identifier:oval:org.mitre.oval:def:10510

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10510