Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to the functions (1) lpad or (2) rpad.

Mordred Labs and others found several vulnerabilities in PostgreSQL, an object-relational SQL database. They are inherited from several buffer overflows and integer overflows. Specially crafted long date and time input, currency, repeat data and long timezone names could cause the PostgreSQL server to crash as well as specially crafted input data for lpad() and rpad(). More buffer/integer overflows were found in circle_poly(), path_encode() and path_addr().

Except for the last three, these problems are fixed in the upstream release 7.2.2 of PostgreSQL which is the recommended version to use.

Most of these problems do not exist in the version of PostgreSQL that Debian ships in the potato release since the corresponding functionality is not yet implemented. However, PostgreSQL 6.5.3 is quite old and may bear more risks than we are aware of, which may include further buffer overflows, and certainly include bugs that threaten the integrity of your data.

You are strongly advised not to use this release but to upgrade your system to Debian 3.0 (stable) including PostgreSQL release 7.2.1 instead, where many bugs have been fixed and new features introduced to increase compatibility with the SQL standards.

If you consider an upgrade, please make sure to dump the entire database system using the pg_dumpall utility. Please take into consideration that the newer PostgreSQL is more strict in its input handling. This means that tests like 'foo = NULL' which are not valid won't be accepted anymore. It also means that when using UNICODE encoding, ISO 8859-1 and ISO 8859-15 are no longer valid encodings to use when inserting data into the relation. In such a case you are advised to convert the dump in question usingrecode latin1..utf-16.

These problems have been fixed in version 7.2.1-2woody2 for the current stable distribution (woody) and in version 7.2.2-2 for the unstable distribution (sid). The old stable distribution (potato) is partially affected and we ship a fixed version 6.5.3-27.2 for it.

The remote PostgreSQL server is vulnerable to various flaws which may allow an attacker who has the right to query the remote database to obtain a shell on this host. 

Vulnerabilities were discovered in the Postgresql relational database by Mordred Labs. These vulnerabilities are buffer overflows in the rpad(), lpad(), repeat(), and cash_words() functions. The Postgresql developers also fixed a buffer overflow in functions that deal with time/date and timezone.

Finally, more buffer overflows were discovered by Mordred Labs in the 7.2.2 release that are currently only fixed in CVS. These buffer overflows exist in the circle_poly(), path_encode(), and path_addr() functions.

In order for these vulnerabilities to be exploited, an attacker must be able to query the server somehow. However, this cannot directly lead to root privilege because the server runs as the postgresql user.

Prior to upgrading, users should dump their database and retain it as backup. You can dump the database by using :

$ pg_dumpall > db.out

If you need to restore from the backup, you can do so by using :

$ psql -f db.out template1

Update :

The previous update missed a few small fixes, including a buffer overflow in the cash_words() function that allows local users to cause a DoS and possibly execute arbitrary code via a malformed argument in Postgresql 7.2 and earlier. As well, buffer overflows in the TZ and SET TIME ZONE environment variables for Postgresql 7.2.1 and earlier can allow local users to cause a DoS and possibly execute arbitrary code.

The remote host is missing the patch for the advisory SUSE-SA:2002:038 (postgresql).


The PostgreSQL Object-Relational DBMS was found vulnerable to several security related buffer overflow problems.
The buffer overflows are located in:
* handling long datetime input
* lpad() and rpad() function with multibyte
* repeat() function
* TZ and SET TIME ZONE environment variables These bugs could just be exploited by attackers who have access to the postgresql server to gain the privileges postgres user ID .

The PostgreSQL package is not installed by default.
A temporary fix is not known.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated PostgreSQL packages are available which correct several minor security vulnerabilities.

[Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1

PostgreSQL is an advanced Object-Relational database management system (DBMS). Red Hat Linux Advanced Server 2.1 shipped with PostgreSQL version 7.1.3 which has several security vulnerabilities.

Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to the lpad or rpad functions. CVE-2002-0972

Buffer overflow in the cash_words() function for PostgreSQL 7.2 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a malformed argument. CVE-2002-1397

Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, referred to as a vulnerability 'in handling long datetime input.' CVE-2002-1398

Heap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string. CVE-2002-1400

Buffer overflows in circle_poly, path_encode, and path_add allow attackers to cause a denial of service and possibly execute arbitrary code. Note that these issues have been fixed in our packages and in PostgreSQL CVS, but are not included in PostgreSQL version 7.2.2 or 7.2.3. CVE-2002-1401

Buffer overflows in the TZ and SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code. CVE-2002-1402

Note that these vulnerabilities are only critical on open or shared systems because connecting to the database is required before the vulnerabilities can be exploited.

The PostgreSQL Global Development Team has released versions of PostgreSQL that fix these vulnerabilities, and these fixes have been isolated and backported into the updated 7.1.3 packages provided with this errata. All users of Red Hat Linux Advanced Server 2.1 who use PostgreSQL are advised to install these updated packages.

ID	Name	Product	Family	Type	Severity
15002	Debian DSA-165-1 : postgresql - buffer overflows	Nessus	Debian Local Security Checks	Local	high
1893	PostgreSQL < 7.2.3 Multiple Vulnerabilities (2) (deprecated)	Nessus Network Monitor	Database		medium
1892	PostgreSQL < 7.2.3 Multiple Vulnerabilities	Nessus Network Monitor	Database		medium
13963	Mandrake Linux Security Advisory : postgresql (MDKSA-2002:062-1)	Nessus	Mandriva Local Security Checks	Local	high
13759	SUSE-SA:2002:038: postgresql	Nessus	SuSE Local Security Checks		medium
12343	RHEL 2.1 : postgresql (RHSA-2002:301)	Nessus	Red Hat Local Security Checks	Local	high

Detections

Analytics

CVE-2002-0972

critical

Tenable Plugins

high

medium

medium

high

medium

high