Multiple buffer overflows in gram.y for PostgreSQL 8.0.1 and earlier may allow attackers to execute arbitrary code via (1) a large number of variables in a SQL statement being handled by the read_sql_construct function, (2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function, (3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function, and (4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function, a different set of vulnerabilities than CVE-2005-0245.

The remote host is running PHP iCalendar, an open-source PHP blog.  This version of iCalendar is vulnerable to a flaw wherein a local user can gain access to confidential data by requesting the data from the iCalendar application.  Successful exploitation would lead to a local user gaining access to confidential data.  In addition, the remote host is vulnerable to a remote file upload flaw.  An attacker exploiting this flaw would be able to manipulate the application into uploading and executing potentially malicious scripts.  

The execution of custom PostgreSQL functions can be restricted with the EXECUTE privilege. However, previous versions did not check this privilege when executing a function which was part of an aggregate. As a result, any database user could circumvent the EXECUTE restriction of functions with a particular (but very common) parameter structure by creating an aggregate wrapper around the function. (CAN-2005-0244)

Several buffer overflows have been discovered in the SQL parser. These could be exploited by any database user to crash the PostgreSQL server or execute arbitrary code with the privileges of the server.
(CAN-2005-0245, CAN-2005-0247)

Finally, this update fixes a Denial of Service vulnerability of the contributed 'intagg' module. By constructing specially crafted arrays, a database user was able to corrupt and crash the PostgreSQL server.
(CAN-2005-0246). Please note that this module is part of the 'postgresql-contrib' package, which is not officially supported by Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PL/PgSQL parser in postgresql is vulnerable to several buffer overflows. These could be exploited by a remote attacker to execute arbitrary code with the permissions of the postgresql server by running a specially crafted query.

The remote host is missing the patch for the advisory SUSE-SA:2005:027 (postgresql).


Several problems were identified and fixed in the PostgreSQL database server.

Multiple buffer overflows in the low level parsing routines may allow attackers to execute arbitrary code via:

(1) a large number of variables in a SQL statement being handled by the read_sql_construct() function,

(2) a large number of INTO variables in a SELECT statement being handled by the make_select_stmt function,

(3) a large number of arbitrary variables in a SELECT statement being handled by the make_select_stmt function, and

(4) a large number of INTO variables in a FETCH statement being handled by the make_fetch_stmt function.


This is tracked by the Mitre CVE ID CVE-2005-0247.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:138 advisory.

    A flaw in the LOAD command in PostgreSQL was discovered. A local user     could use this flaw to load arbitrary shared libraries and therefore     execute arbitrary code, gaining the privileges of the PostgreSQL server.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0227 to this issue.

    A permission checking flaw in PostgreSQL was discovered. A local user     could bypass the EXECUTE permission check for functions by using the CREATE     AGGREGATE command. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0244 to this issue.

    Multiple buffer overflows were found in PL/PgSQL. A database user who has     permissions to create plpgsql functions could trigger this flaw which could     lead to arbitrary code execution, gaining the privileges of the PostgreSQL     server. The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the names CAN-2005-0245 and CAN-2005-0247 to these issues.

    A flaw in the integer aggregator (intagg) contrib module for PostgreSQL was     found. A user could create carefully crafted arrays and cause a denial of     service (crash). The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0246 to this issue.

    The update also fixes some minor problems, notably conflicts with SELinux.

    Users of postgresql should update to these erratum packages that contain     patches and are not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A number of vulnerabilities were found and corrected in the PostgreSQL DBMS :

A flaw in the LOAD command could be abused by a local user to load arbitrary shared libraries and as a result execute arbitrary code with the privileges of the user running the postgresql server (CVE-2005-0227).

A permission checking flaw was found where a local user could bypass the EXECUTE permission check for functions using the CREATE AGGREGATE command (CVE-2005-0244).

Multiple buffer overflows were discovered in PL/PgSQL. A database user with permission to create plpgsql functions could trigger these flaws which could then lead to arbitrary code execution with the privileges of the user running the postgresql server (CVE-2005-0245 and CVE-2005-0247).

Finally, a flaw in the integer aggregator (intagg) contrib module was found. A user could create carefully crafted arrays and crash the server, causing a Denial of Service (CVE-2005-0246).

The updated packages have been patched to correct these problems.

Updated PostgreSQL packages to fix various security flaws are now available for Red Hat Enterprise Linux 2.1AS.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw in the LOAD command in PostgreSQL was discovered. A local user could use this flaw to load arbitrary shared libraries and therefore execute arbitrary code, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0227 to this issue.

Multiple buffer overflows were found in PL/PgSQL. A database user who has permissions to create plpgsql functions could trigger this flaw which could lead to arbitrary code execution, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0245 and CVE-2005-0247 to these issues.

Users of PostgreSQL are advised to update to these erratum packages which are not vulnerable to these issues.

Several buffer overflows have been discovered in PL/PgSQL as part of the PostgreSQL engine which could lead to the execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200502-19 (PostgreSQL: Buffer overflows in PL/PgSQL parser)

    PostgreSQL is vulnerable to several buffer overflows in the PL/PgSQL     parser.
  Impact :

    A remote attacker could send a malicious query resulting in the     execution of arbitrary code with the permissions of the user running     PostgreSQL.
  Workaround :

    There is no known workaround at this time.

Updated PostgreSQL packages to fix various security flaws are now available for Red Hat Enterprise Linux 3.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw in the LOAD command in PostgreSQL was discovered. A local user could use this flaw to load arbitrary shared librarys and therefore execute arbitrary code, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0227 to this issue.

A permission checking flaw in PostgreSQL was discovered. A local user could bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0244 to this issue.

Multiple buffer overflows were found in PL/PgSQL. A database user who has permissions to create plpgsql functions could trigger this flaw which could lead to arbitrary code execution, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0245 and CVE-2005-0247 to these issues.

A flaw in the integer aggregator (intagg) contrib module for PostgreSQL was found. A user could create carefully crafted arrays and cause a denial of service (crash). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0246 to this issue.

Users of PostgreSQL are advised to update to these erratum packages which are not vulnerable to these issues.

The remote PostgreSQL server, according to its version number, is vulnerable to multiple flaws that could allow an attacker who has the rights to query the remote database to obtain a shell on this host.

The remote PostgreSQL server is vulnerable to a number of critical flaws.  Some of these flaws require an attacker to have a valid account with credentials; however, some of the attacks do not require the attacker to have any sort of credentials.

ID	Name	Product	Family	Severity
3479	PHP iCalendar Local File Inclusion	Nessus Network Monitor	CGI	high
20702	Ubuntu 4.10 : postgresql vulnerabilities (USN-79-1)	Nessus	Ubuntu Local Security Checks	high
18973	FreeBSD : postgresql -- multiple buffer overflows in PL/PgSQL parser (6b4b0b3f-8127-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18113	SUSE-SA:2005:027: postgresql	Nessus	SuSE Local Security Checks	medium
17192	RHEL 4 : postgresql (RHSA-2005:138)	Nessus	Red Hat Local Security Checks	critical
17139	Mandrake Linux Security Advisory : postgresql (MDKSA-2005:040)	Nessus	Mandriva Local Security Checks	high
17129	RHEL 2.1 : postgresql (RHSA-2005:150)	Nessus	Red Hat Local Security Checks	high
16465	Debian DSA-683-1 : postgresql - buffer overflows	Nessus	Debian Local Security Checks	high
16460	GLSA-200502-19 : PostgreSQL: Buffer overflows in PL/PgSQL parser	Nessus	Gentoo Local Security Checks	medium
16386	RHEL 3 : rh-postgresql (RHSA-2005:141)	Nessus	Red Hat Local Security Checks	high
16309	PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 Multiple Vulnerabilities	Nessus	Databases	medium
2583	PostgreSQL < 8.0.1 Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2005-0247

critical

Tenable Plugins

high

high

medium

medium

critical

high

high

high

medium

high

medium

medium