Detections
Analytics
PostgreSQL < 8.0.3 Incorrect Function Declaration
medium Nessus Network Monitor Plugin ID 2876
Synopsis
The remote host is vulnerable to a flaw that allows for the bypassing of authentication.Description
The remote host is running PostgreSQL, an open source relational database. This version is vulnerable to a number of flaws. Specifically, the following functions are directly accessible to remote users:dex_init()
snb_en_init()
snb_ru_init()
spell_init()
syn_init()
An attacker calling these functions can submit queries that lead to compromise of confidential data or execution of arbitrary code on the remote database server.
Solution
Upgrade to PostgreSQL 8.0.3 or higher.See Also
http://www.postgresql.org/about/news.315
http://developer.postgresql.org/docs/postgres/release-8-0-3.html
Plugin Details
Severity: Medium
ID: 2876
Family: Database
Published: 5/4/2005
Updated: 3/6/2019
Nessus ID: 18202
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS v3
Risk Factor: Medium
Base Score: 6.3
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:postgresql:postgresql
Reference Information
CVE: CVE-2005-1409, CVE-2005-1410