Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."

SunOS 5.10_x86: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

SunOS 5.10: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0336 advisory.

    [7.4.17-1.RHEL4.1]
     - Update to PostgreSQL 7.4.17 for CVE-2007-2138, data loss bugs        Resolves: #237680

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way PostgreSQL allows authenticated users to execute security-definer functions. It was possible for an unprivileged user to execute arbitrary code with the privileges of the security-definer function. (CVE-2007-2138)

Updated postgresql packages that fix several security issues are now available.

A flaw was found in the way PostgreSQL allows authenticated users to execute security-definer functions. It was possible for an unprivileged user to execute arbitrary code with the privileges of the security-definer function. (CVE-2007-2138)

PostgreSQL did not handle the 'search_path' configuration option in a secure way for functions declared as 'SECURITY DEFINER'. 

Previously, an attacker could override functions and operators used by the security definer function to execute arbitrary SQL commands with the privileges of the user who created the security definer function.
The updated version does not search the temporary table schema for functions and operators any more.

Similarly, an attacker could put forged tables into the temporary table schema to trick the security definer function into using attacker defined data for processing. This was possible because the temporary schema was always implicitly searched first before all other entries in 'search_path'. The updated version now supports explicit placement of the temporary schema. Please see the HTML documentation or the manual page for 'CREATE FUNCTION' for details and an example how to write security definer functions in a secure way.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to PostgreSQL 8.2.4 for CVE-2007-2138, data loss bugs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the PostgreSQL database performs insufficient validation of variables passed to privileged SQL statement called'security definers', which could lead to SQL privilege escalation.

It was discovered that the PostgreSQL database performs insufficient validation of variables passed to privileged SQL statements, so called'security definers', which could lead to SQL privilege escalation.

The oldstable distribution (sarge) doesn't contain PostgreSQL 8.1.

The remote host is affected by the vulnerability described in GLSA-200705-12 (PostgreSQL: Privilege escalation)

    An error involving insecure search_path settings in the SECURITY     DEFINER functions has been reported in PostgreSQL.
  Impact :

    If allowed to call a SECURITY DEFINER function, an attacker could gain     the SQL privileges of the owner of the called function.
  Workaround :

    There is no known workaround at this time.

Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw was found in the way PostgreSQL allows authenticated users to execute security-definer functions. It was possible for an unprivileged user to execute arbitrary code with the privileges of the security-definer function. (CVE-2007-2138)

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 8.1.9, 7.4.17, and 7.3.19 which corrects this issue.

A weakness in previous versions of PostgreSQL was found in the security definer functions in which an authenticated but otherwise unprivileged SQL user could use temporary objects to execute arbitrary code with the privileges of the security-definer function.

IMPORTANT NOTICE FOR CORPORATE SERVER/DESKTOP 3.0 USERS :

In addition, packages for Corporate Server/Desktop 3.0 have been updated to the latest PostgreSQL 7.4.17 which requires some attention when upgrading. To take advantage of the new version, and to ensure data coherency, we strongly recommend dumping the old databases, re-initializing the database, and then reloading the dumped data. This can be accomplished as root using :

# service postgresql start # su - postgres $ pg_dumpall >/tmp/database.dump $ exit # service postgresql stop # mv /var/lib/pgsql /var/lib/pgsql.bk # urpmi.update -a &amp;&amp; urpmi
--auto-select # service postgresql start # service postgresql restart # su - postgres $ /usr/bin/psql -d template1 -f /tmp/database.dump $ exit

Only Corporate Server/Desktop 3.0 requires the dump/reload steps; the other Mandriva Linux platforms do not require this step. Notice that the double-restart of the postgresql service is in fact required.

Updated packages have been patched to correct this issue.

The remote host is running PostgreSQL, an open source relational database.  This version is vulnerable to a local 'privilege escalation' flaw.  By accessing temporary objects, a local user can escalate privileges.  Successful exploitation would allow the local user to gain access elevated access to PostgreSQL data.

SunOS 5.10_x86: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

This plugin has been deprecated and either replaced with individual 123591 patch-revision plugins, or deemed non-security related.

SunOS 5.10: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

This plugin has been deprecated and either replaced with individual 123590 patch-revision plugins, or deemed non-security related.

ID	Name	Product	Family	Severity
107893	Solaris 10 (x86) : 123591-12	Nessus	Solaris Local Security Checks	medium
107391	Solaris 10 (sparc) : 123590-12	Nessus	Solaris Local Security Checks	medium
67488	Oracle Linux 5 : Moderate: / postgresql (ELSA-2007-0336)	Nessus	Oracle Linux Local Security Checks	medium
60177	Scientific Linux Security Update : postgresql on on SL3.0.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60176	Scientific Linux Security Update : postgresql on SL4 i386,x86_64, SL5 i386	Nessus	Scientific Linux Local Security Checks	medium
28052	Ubuntu 6.06 LTS / 6.10 / 7.04 : postgresql-8.1, postgresql-8.2 vulnerability (USN-454-1)	Nessus	Ubuntu Local Security Checks	medium
27652	Fedora 7 : postgresql-8.2.4-1.fc7 (2007-0174)	Nessus	Fedora Local Security Checks	medium
25555	Debian DSA-1311-1 : postgresql-7.4 - programming error	Nessus	Debian Local Security Checks	medium
25531	Debian DSA-1309-1 : postgresql-8.1 - programming error	Nessus	Debian Local Security Checks	medium
25208	GLSA-200705-12 : PostgreSQL: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
25192	RHEL 3 / 4 / 5 : postgresql (RHSA-2007:0336)	Nessus	Red Hat Local Security Checks	medium
25175	CentOS 3 / 4 / 5 : postgresql (CESA-2007:0336)	Nessus	CentOS Local Security Checks	medium
25115	Mandrake Linux Security Advisory : postgresql (MDKSA-2007:094)	Nessus	Mandriva Local Security Checks	medium
3973	PostgreSQL SECURITY DEFINER Functions Local Privilege Escalation	Nessus Network Monitor	Database	medium
24849	Solaris 10 (x86) : 123591-12 (deprecated)	Nessus	Solaris Local Security Checks	medium
24845	Solaris 10 (sparc) : 123590-12 (deprecated)	Nessus	Solaris Local Security Checks	medium

Detections

Analytics

CVE-2007-2138

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium