Detections
Analytics
Debian DSA-1900-1 : postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4 - several vulnerabilities
medium Nessus Plugin ID 44765
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in PostgreSQL, a SQL database system. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2009-3229 Authenticated users can shut down the backend server by re-LOAD-ing libraries in $libdir/plugins, if any libraries are present there. (The old stable distribution (etch) is not affected by this issue.)
- CVE-2009-3230 Authenticated non-superusers can gain database superuser privileges if they can create functions and tables due to incorrect execution of functions in functional indexes.
- CVE-2009-3231 If PostgreSQL is configured with LDAP authentication, and the LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password. (The old stable distribution (etch) is not affected by this issue.)
In addition, this update contains reliability improvements which do not target security issues.
Solution
Upgrade the PostgreSQL packages.For the old stable distribution (etch), these problems have been fixed in version 7.4.26-0etch1 of the postgresql-7.4 source package, and version 8.1.18-0etch1 of the postgresql-8.1 source package.
For the stable distribution (lenny), these problems have been fixed in version 8.3.8-0lenny1 of the postgresql-8.3 source package.
See Also
https://security-tracker.debian.org/tracker/CVE-2009-3229
https://security-tracker.debian.org/tracker/CVE-2009-3230
Plugin Details
Severity: Medium
ID: 44765
File Name: debian_DSA-1900.nasl
Version: 1.13
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 2/24/2010
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:postgresql-7.4, p-cpe:/a:debian:debian_linux:postgresql-8.1, p-cpe:/a:debian:debian_linux:postgresql-8.3, p-cpe:/a:debian:debian_linux:postgresql-8.4, cpe:/o:debian:debian_linux:4.0, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Patch Publication Date: 10/2/2009