backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an UPDATE statement, which are not properly handled during a "MIN/MAX index optimization."

From Red Hat Security Advisory 2007:0064 :

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw was found in the way the PostgreSQL server handles certain SQL-language functions. An authenticated user could execute a sequence of commands which could crash the PostgreSQL server or possibly read from arbitrary memory locations. A user would need to have permissions to drop and add database tables to be able to exploit this issue (CVE-2007-0555).

A denial of service flaw was found affecting the PostgreSQL server running on Red Hat Enterprise Linux 4 systems. An authenticated user could execute a SQL command which could crash the PostgreSQL server.
(CVE-2006-5540)

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 7.4.16 or 7.3.18, which correct these issues.

The SQL Server PostgreSQL has been updated to fix the following security problems :

  - backend/parser/analyze.c in PostgreSQL 8.1.x allowed     remote authenticated users to cause a denial of service     (daemon crash) via certain aggregate functions in an     UPDATE statement, which are not properly handled during     a 'MIN/MAX index optimization.'. (CVE-2006-5540)

  - backend/parser/parse_coerce.c in PostgreSQL 7.4.1     through 7.4.14, 8.0.x before 8.0.9, and 8.1.x before     8.1.5 allows remote authenticated users to cause a     denial of service (daemon crash) via a coercion of an     unknown element to ANYARRAY. (CVE-2006-5541)

  - backend/tcop/postgres.c in PostgreSQL 8.1.x before 8.1.5     allows remote authenticated users to cause a denial of     service (daemon crash) related to duration logging of     V3-protocol Execute messages for (1) COMMIT and (2)     ROLLBACK SQL statements. (CVE-2006-5542)

USN-369-1 fixed three minor PostgreSQL 8.1 vulnerabilities for Ubuntu 6.06 LTS. This update provides the corresponding update for Ubuntu 6.10.

Michael Fuhr discovered an incorrect type check when handling unknown literals. By attempting to coerce such a literal to the ANYARRAY type, a local authenticated attacker could cause a server crash.
(CVE-2006-5541)

Josh Drake and Alvaro Herrera reported a crash when using aggregate functions in UPDATE statements. A local authenticated attacker could exploit this to crash the server backend. This update disables this construct, since it is not very well defined and forbidden by the SQL standard. (CVE-2006-5540)

Sergey Koposov discovered a flaw in the duration logging.
This could cause a server crash under certain circumstances.
(CVE-2006-5542)

Please note that these flaws can usually not be exploited through web and other applications that use a database and are exposed to untrusted input, so these flaws do not pose a threat in usual setups.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Michael Fuhr discovered an incorrect type check when handling unknown literals. By attempting to coerce such a literal to the ANYARRAY type, a local authenticated attacker could cause a server crash.

Josh Drake and Alvaro Herrera reported a crash when using aggregate functions in UPDATE statements. A local authenticated attacker could exploit this to crash the server backend. This update disables this construct, since it is not very well defined and forbidden by the SQL standard.

Sergey Koposov discovered a flaw in the duration logging. This could cause a server crash under certain circumstances.

Please note that these flaws can usually not be exploited through web and other applications that use a database and are exposed to untrusted input, so these flaws do not pose a threat in usual setups.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

Two flaws were found in the way the PostgreSQL server handles certain SQL-language functions. An authenticated user could execute a sequence of commands which could crash the PostgreSQL server or possibly read from arbitrary memory locations. A user would need to have permissions to drop and add database tables to be able to exploit these issues (CVE-2007-0555, CVE-2007-0556).

Several denial of service flaws were found in the PostgreSQL server.
An authenticated user could execute certain SQL commands which could crash the PostgreSQL server (CVE-2006-5540, CVE-2006-5541, CVE-2006-5542).

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 8.1.8 which corrects these issues.

A vulnerability in PostgreSQL 8.1.x allowed remote authenticated users to cause a Denial of Service (daemon crash) via certain aggregate functions in an UPDATE statement which were not handled correctly (CVE-2006-5540).

Another DoS issue in PostgreSQL 7.4.x, 8.0.x, and 8.1.x allowed remote authenticated users to crash the daemon via a coercion of an unknown element to ANYARRAY (CVE-2006-5541).

Finally, another vulnerability in 8.1.x could allow a remote authenticated user to cause a DoS related to duration logging of V3-protocol Execute message for COMMIT and ROLLBACK statements (CVE-2006-5542).

This updated provides the latest 8.0.x and 8.1.x PostgreSQL versions and patches the version of PostgreSQL shipped with Corporate 3.0.

After installing this upgrade, you will need to execute 'service postgresql restart' for it to take effect.

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw was found in the way the PostgreSQL server handles certain SQL-language functions. An authenticated user could execute a sequence of commands which could crash the PostgreSQL server or possibly read from arbitrary memory locations. A user would need to have permissions to drop and add database tables to be able to exploit this issue (CVE-2007-0555).

A denial of service flaw was found affecting the PostgreSQL server running on Red Hat Enterprise Linux 4 systems. An authenticated user could execute a SQL command which could crash the PostgreSQL server.
(CVE-2006-5540)

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 7.4.16 or 7.3.18, which correct these issues.

The remote host is running PostgreSQL, an open source relational database.  This version is vulnerable to multiple flaws where an attacker with local access can cause the service to stop.  Successful exploitation would result in the system being unavailable to legitimate users. 

ID	Name	Product	Family	Severity
67447	Oracle Linux 3 / 4 : postgresql (ELSA-2007-0064)	Nessus	Oracle Linux Local Security Checks	high
29557	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 2276)	Nessus	SuSE Local Security Checks	medium
27950	Ubuntu 6.10 : postgresql-8.1 vulnerabilities (USN-369-2)	Nessus	Ubuntu Local Security Checks	medium
27949	Ubuntu 6.06 LTS : postgresql-8.1 vulnerabilities (USN-369-1)	Nessus	Ubuntu Local Security Checks	medium
25315	RHEL 5 : postgresql (RHSA-2007:0068)	Nessus	Red Hat Local Security Checks	high
24579	Mandrake Linux Security Advisory : postgresql (MDKSA-2006:194)	Nessus	Mandriva Local Security Checks	medium
24319	RHEL 3 / 4 : postgresql (RHSA-2007:0064)	Nessus	Red Hat Local Security Checks	high
24290	CentOS 3 / 4 : postgresql (CESA-2007:0064)	Nessus	CentOS Local Security Checks	high
3798	PostgreSQL Multiple Local DoS Vulnerabilities	Nessus Network Monitor	Database	low

Detections

Analytics

CVE-2006-5540

medium

Tenable Plugins

high

medium

medium

medium

high

medium

high

high

low