PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.

The remote host is running PHP iCalendar, an open-source PHP blog.  This version of iCalendar is vulnerable to a flaw wherein a local user can gain access to confidential data by requesting the data from the iCalendar application.  Successful exploitation would lead to a local user gaining access to confidential data.  In addition, the remote host is vulnerable to a remote file upload flaw.  An attacker exploiting this flaw would be able to manipulate the application into uploading and executing potentially malicious scripts.  

John Heasman and others disovered that non-privileged users could use the LOAD extension to load arbitrary libraries into the postgres server process space. This could be used by non-privileged local users to execute arbitrary code with the privileges of the postgresql server.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:138 advisory.

    A flaw in the LOAD command in PostgreSQL was discovered. A local user     could use this flaw to load arbitrary shared libraries and therefore     execute arbitrary code, gaining the privileges of the PostgreSQL server.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0227 to this issue.

    A permission checking flaw in PostgreSQL was discovered. A local user     could bypass the EXECUTE permission check for functions by using the CREATE     AGGREGATE command. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0244 to this issue.

    Multiple buffer overflows were found in PL/PgSQL. A database user who has     permissions to create plpgsql functions could trigger this flaw which could     lead to arbitrary code execution, gaining the privileges of the PostgreSQL     server. The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the names CAN-2005-0245 and CAN-2005-0247 to these issues.

    A flaw in the integer aggregator (intagg) contrib module for PostgreSQL was     found. A user could create carefully crafted arrays and cause a denial of     service (crash). The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0246 to this issue.

    The update also fixes some minor problems, notably conflicts with SELinux.

    Users of postgresql should update to these erratum packages that contain     patches and are not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A number of vulnerabilities were found and corrected in the PostgreSQL DBMS :

A flaw in the LOAD command could be abused by a local user to load arbitrary shared libraries and as a result execute arbitrary code with the privileges of the user running the postgresql server (CVE-2005-0227).

A permission checking flaw was found where a local user could bypass the EXECUTE permission check for functions using the CREATE AGGREGATE command (CVE-2005-0244).

Multiple buffer overflows were discovered in PL/PgSQL. A database user with permission to create plpgsql functions could trigger these flaws which could then lead to arbitrary code execution with the privileges of the user running the postgresql server (CVE-2005-0245 and CVE-2005-0247).

Finally, a flaw in the integer aggregator (intagg) contrib module was found. A user could create carefully crafted arrays and crash the server, causing a Denial of Service (CVE-2005-0246).

The updated packages have been patched to correct these problems.

Updated PostgreSQL packages to fix various security flaws are now available for Red Hat Enterprise Linux 2.1AS.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw in the LOAD command in PostgreSQL was discovered. A local user could use this flaw to load arbitrary shared libraries and therefore execute arbitrary code, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0227 to this issue.

Multiple buffer overflows were found in PL/PgSQL. A database user who has permissions to create plpgsql functions could trigger this flaw which could lead to arbitrary code execution, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0245 and CVE-2005-0247 to these issues.

Users of PostgreSQL are advised to update to these erratum packages which are not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200502-08 (PostgreSQL: Multiple vulnerabilities)

    PostgreSQL's contains several vulnerabilities:
    John Heasman discovered that the LOAD extension is vulnerable to     local privilege escalation (CAN-2005-0227).
    It is possible to bypass the EXECUTE permission check for functions     (CAN-2005-0244).
    The PL/PgSQL parser is vulnerable to heap-based buffer overflow     (CAN-2005-0244).
    The intagg contrib module is vulnerable to a Denial of Service     (CAN-2005-0246).
  Impact :

    An attacker could exploit this to execute arbitrary code with the     privileges of the PostgreSQL server, bypass security restrictions and     crash the server.
  Workaround :

    There is no know workaround at this time.

Updated PostgreSQL packages to fix various security flaws are now available for Red Hat Enterprise Linux 3.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw in the LOAD command in PostgreSQL was discovered. A local user could use this flaw to load arbitrary shared librarys and therefore execute arbitrary code, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0227 to this issue.

A permission checking flaw in PostgreSQL was discovered. A local user could bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0244 to this issue.

Multiple buffer overflows were found in PL/PgSQL. A database user who has permissions to create plpgsql functions could trigger this flaw which could lead to arbitrary code execution, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0245 and CVE-2005-0247 to these issues.

A flaw in the integer aggregator (intagg) contrib module for PostgreSQL was found. A user could create carefully crafted arrays and cause a denial of service (crash). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0246 to this issue.

Users of PostgreSQL are advised to update to these erratum packages which are not vulnerable to these issues.

John Heasman and others discovered a bug in the PostgreSQL engine which would allow any user load an arbitrary local library into it.

The remote PostgreSQL server, according to its version number, is vulnerable to multiple flaws that could allow an attacker who has the rights to query the remote database to obtain a shell on this host.

The remote PostgreSQL server is vulnerable to a number of critical flaws.  Some of these flaws require an attacker to have a valid account with credentials; however, some of the attacks do not require the attacker to have any sort of credentials.

ID	Name	Product	Family	Severity
3479	PHP iCalendar Local File Inclusion	Nessus Network Monitor	CGI	high
18949	FreeBSD : postgresql -- privilege escalation vulnerability (5d425189-7a03-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
17192	RHEL 4 : postgresql (RHSA-2005:138)	Nessus	Red Hat Local Security Checks	critical
17139	Mandrake Linux Security Advisory : postgresql (MDKSA-2005:040)	Nessus	Mandriva Local Security Checks	high
17129	RHEL 2.1 : postgresql (RHSA-2005:150)	Nessus	Red Hat Local Security Checks	high
16445	GLSA-200502-08 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
16386	RHEL 3 : rh-postgresql (RHSA-2005:141)	Nessus	Red Hat Local Security Checks	high
16342	Debian DSA-668-1 : postgresql - privilege escalation	Nessus	Debian Local Security Checks	medium
16309	PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 Multiple Vulnerabilities	Nessus	Databases	medium
2583	PostgreSQL < 8.0.1 Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2005-0227

high

Tenable Plugins

high

medium

critical

high

high

high

high

medium

medium

medium