The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - GNU cpio
  - GNU cpio on 64-bit
  - GNU tar
  - Kerberos 5
  - Perl
  - PostgreSQL
  - Safe Module for Perl Automagic Methods
  - Samba smbd

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially vulnerable to multiple vulnerabilities, the worst of which may allow an authenticated user to trigger a denial of service condition or execute arbitrary code.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0458 advisory.

    - CVE-2008-5302 - use latest patch without Cwd module
    - CVE-2008-5302 perl: File::Path rmtree race condition (CVE-2005-0448)       reintroduced after upstream rebase to 5.8.8-1
    - CVE-2010-1168 perl Safe: Intended restriction bypass via object references
    - CVE-2010-1447 Safe 2.26 and earlier: Intended restriction bypass via Perl       object references in code executed outside safe compartment

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2010:0457 :

Updated perl packages that fix two security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Safe extension module allows users to compile and execute Perl code in restricted compartments.

The Safe module did not properly restrict the code of implicitly called methods (such as DESTROY and AUTOLOAD) on implicitly blessed objects returned as a result of unsafe code evaluation. These methods could have been executed unrestricted by Safe when such objects were accessed or destroyed. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions. (CVE-2010-1168)

The Safe module did not properly restrict code compiled in a Safe compartment and executed out of the compartment via a subroutine reference returned as a result of unsafe code evaluation. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions, if the returned subroutine reference was called from outside of the compartment.
(CVE-2010-1447)

Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1168 and CVE-2010-1447 issues. Upstream acknowledges Nick Cleaton as the original reporter of CVE-2010-1168, and Tim Bunce and Rafael Garcia-Suarez as the original reporters of CVE-2010-1447.

These packages upgrade the Safe extension module to version 2.27.
Refer to the Safe module's Changes file, linked to in the References, for a full list of changes.

Users of perl are advised to upgrade to these updated packages, which correct these issues. All applications using the Safe extension module must be restarted for this update to take effect.

From Red Hat Security Advisory 2010:0428 :

Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted.

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server.
(CVE-2010-1169)

Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw.

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server.
(CVE-2010-1170)

A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442)

An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733)

PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136)

These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Safe extension module allows users to compile and execute Perl code in restricted compartments. The File::Path module allows users to create and remove directory trees.

The Safe module did not properly restrict the code of implicitly called methods (such as DESTROY and AUTOLOAD) on implicitly blessed objects returned as a result of unsafe code evaluation. These methods could have been executed unrestricted by Safe when such objects were accessed or destroyed. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions. (CVE-2010-1168)

The Safe module did not properly restrict code compiled in a Safe compartment and executed out of the compartment via a subroutine reference returned as a result of unsafe code evaluation. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions, if the returned subroutine reference was called from outside of the compartment.
(CVE-2010-1447)

Multiple race conditions were found in the way the File::Path module's rmtree function removed directory trees. A malicious, local user with write access to a directory being removed by a victim, running a Perl script using rmtree, could cause the permissions of arbitrary files to be changed to world-writable and setuid, or delete arbitrary files via a symbolic link attack, if the victim had the privileges to change the permissions of the target files or to remove them. (CVE-2008-5302, CVE-2008-5303)

These packages upgrade the Safe extension module to version 2.27.
Refer to the Safe module's Changes file at the following link for a full list of changes.
http://cpansearch.perl.org/src/RGARCIA/Safe-2.27/Changes

All applications using the Safe or File::Path modules must be restarted for this update to take effect.

NOTE: SL 50-52 x86_64 releases originally had a perl.i386 package. It was taken out of the x86_64 SL5 distribution and is not part of this security update. If you have one of these earlier SL5 x86_64 distributions and your perl update does not work due to conflicts, you should do a 'yum remove perl.i386' before doing your update on these earlier SL 5 x86_64 releases.

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Safe extension module allows users to compile and execute Perl code in restricted compartments.

The Safe module did not properly restrict the code of implicitly called methods (such as DESTROY and AUTOLOAD) on implicitly blessed objects returned as a result of unsafe code evaluation. These methods could have been executed unrestricted by Safe when such objects were accessed or destroyed. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions. (CVE-2010-1168)

The Safe module did not properly restrict code compiled in a Safe compartment and executed out of the compartment via a subroutine reference returned as a result of unsafe code evaluation. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions, if the returned subroutine reference was called from outside of the compartment.
(CVE-2010-1447)

These packages upgrade the Safe extension module to version 2.27.
Refer to the Safe module's Changes file at the following link for a full list of changes.
http://cpansearch.perl.org/src/RGARCIA/Safe-2.27/Changes

All applications using the Safe extension module must be restarted for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201110-22 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote authenticated attacker could send a specially crafted SQL query       to a PostgreSQL server with the 'intarray' module enabled, possibly       resulting in the execution of arbitrary code with the privileges of the       PostgreSQL server process, or a Denial of Service condition. Furthermore,       a remote authenticated attacker could execute arbitrary Perl code, cause       a Denial of Service condition via different vectors, bypass LDAP       authentication, bypass X.509 certificate validation, gain database       privileges, exploit weak blowfish encryption and possibly cause other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

It was discovered that Perl's Safe module - a module to compile and execute code in restricted compartments - could be bypassed.

Please note that this update is known to break Petal, an XML-based templating engine (shipped with Debian 6.0/Squeeze in the package libpetal-perl, see bug #582805 for details). A fix is not yet available. If you use Petal, you might consider to put the previous Perl packages on hold.

It was discovered that the Safe.pm Perl module incorrectly handled Safe::reval and Safe::rdo access restrictions. An attacker could use this flaw to bypass intended restrictions and possibly execute arbitrary code. (CVE-2010-1168, CVE-2010-1447)

It was discovered that the CGI.pm Perl module incorrectly handled certain MIME boundary strings. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-2761, CVE-2010-4411)

It was discovered that the CGI.pm Perl module incorrectly handled newline characters. An attacker could use this flaw to inject arbitrary HTTP headers and perform HTTP response splitting and cross-site scripting attacks. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 10.04 LTS and 10.10. (CVE-2010-4410)

It was discovered that the lc, lcfirst, uc, and ucfirst functions did not properly apply the taint attribute when processing tainted input.
An attacker could use this flaw to bypass intended restrictions. This issue only affected Ubuntu 8.04 LTS, 10.04 LTS and 10.10.
(CVE-2011-1487).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution (CVE-2010-1447 / CVE-2010-1168).
This update fixes this problem.

It also fixes the following bugs :

  - fix tell cornercase [bnc#596167]

  - fix regex memory leak [bnc#557636]

  - also run h2ph on /usr/include/linux [bnc#603840]

  - backport h2ph include fix from 5.12.0 [bnc#601242]

  - fix segfault when using regexpes in threaded apps     [bnc#588338]

  - backport upstream fixes for POSIX module to avoid     clashes with Fcntl [bnc#446098], [bnc#515948]

  - backport upstream fix for ISA assertion failure     [bnc#528423]

  - move unicode files from perl-doc to perl, otherwise some     perl modules will not work

perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution (CVE-2010-1447 / CVE-2010-1168).
This update fixes this problem.

a. Service Console update for cpio

   The service console package cpio is updated to version 2.5-6.RHEL3    for ESX 3.x versions and updated to version 2.6-23.el5_4.1 for    ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2005-4268 and CVE-2010-0624 to the issues    addressed in the update for ESX 3.x and the names CVE-2007-4476 and    CVE-2010-0624 to the issues addressed in the update for ESX 4.x.

b. Service Console update for tar

   The service console package tar is updated to version    1.13.25-16.RHEL3 for ESX 3.x versions and updated to version    1.15.1-23.0.1.el5_4.2 for ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0624 to the issue addressed in the    update for ESX 3.x and the names CVE-2007-4476 and CVE-2010-0624    to the issues addressed in the update for ESX 4.x.

c. Service Console update for samba

   The service console packages for samba are updated to version    samba-3.0.9-1.3E.17vmw, samba-client-3.0.9-1.3E.17vmw and    samba-common-3.0.9-1.3E.17vmw.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2063 to the issue addressed in this    update.

   Note :
   The issue mentioned above is present in the Samba server (smbd) and    is not present in the Samba client or Samba common packages.

   To determine if your system has Samba server installed do a    'rpm -q samba`.

   The following lists when the Samba server is installed on the ESX    service console :

   - ESX 4.0, ESX 4.1      The Samba server is not present on ESX 4.0 and ESX 4.1.

   - ESX 3.5      The Samba server is present if an earlier patch for Samba has been      installed.

   - ESX 3.0.3      The Samba server is present if ESX 3.0.3 was upgraded from an      earlier version of ESX 3 and a Samba patch was installed on that      version.

   The Samba server is not needed to operate the service console and    can be be disabled without loss of functionality to the service    console.

d. Service Console update for krb5

   The service console package krb5 is updated to version 1.2.7-72    for ESX 3.x versions and to version 1.6.1-36.el5_5.4 for ESX 4.x    versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-1321 to the issue addressed in    these updates.

e. Service Console update for perl

   The service console package perl is updated to version    5.8.0-101.EL3 for ESX 3.x versions and version 5.8.8-32.el5_5.1    for ESX 4.x versions.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-1168 and CVE-2010-1447 to the issues    addressed in the update for ESX 3.x and the names CVE-2008-5302,    CVE-2008-5303, CVE-2010-1168, and CVE-2010-1447 to the issues    addressed in the update for ESX 4.x.

perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution (CVE-2010-1447, CVE-2010-1168).
This update fixes this problem.

perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution. (CVE-2010-1447 , CVE-2010-1168)

This update fixes this problem. Also following non-security bugs were fixed :

  - fix tell cornercase [bnc#596167]

  - fix regex memory leak [bnc#557636]

  - do not add vendorlib/auto to filelist [bnc#624628]

  - also run h2ph on /usr/include/linux [bnc#603840]

  - backport h2ph include fix from 5.12.0 [bnc#601242]

perl Safe.pm module was affected by two problems where attackers could break out of such a safed execution. (CVE-2010-1447 , CVE-2010-1168)

This update fixes this problem. Also the following bugs were fixed :

  - fix tell cornercase [bnc#596167]

  - fix regex memory leak [bnc#557636]

  - also run h2ph on /usr/include/linux [bnc#603840]

  - backport h2ph include fix from 5.12.0 [bnc#601242]

  - fix segfault when using regexpes in threaded apps     [bnc#588338]

  - backport upstream fixes for POSIX module to avoid     clashes with Fcntl [bnc#446098], [bnc#515948]

  - backport upstream fix for ISA assertion failure     [bnc#528423]

  - move unicode files from perl-doc to perl, otherwise some     perl modules will not work

- Wed Jul 21 2010 Marcela Maslaova <mmaslano at     redhat.com> - 4:5.10.0-91

    - CVE-2010-1168 perl Safe: Intended restriction bypass       via object references

    - CVE-2010-1447 perl: Safe restriction bypass when       reference to subroutine in compartment is called from       outside

  - 576824 RT#73814 - unpack() didn't handle scalar context     correctly

    - Resolves: rhbz#588269, rhbz#576508

    - Fri Jul 9 2010 Petr Pisar <ppisar at redhat.com> -       4:5.10.0-90

    - Add Digest::SHA requirement to perl-CPAN and       perl-CPANPLUS (bug #612563)

    - Wed Jul 7 2010 Petr Pisar <ppisar at redhat.com> -       4:5.10.0-89

    - Fix perl-5.10.0-Encode-err.patch patch to be       applicable

    - Fix incorrect return code on failed extraction by       upgrading Archive::Tar to 1.62 (bug #607687)

  - Wed Mar 17 2010 Marcela Maslaova <mmaslano at     redhat.com> - 4:5.10.0-88

    - rebuild, e.g. Patch62 is missing in koji build

    - Tue Dec 1 2009 Stepan Kasal <skasal at redhat.com> -       4:5.10.0-87

    - fix patch-update-Compress-Raw-Zlib.patch (did not       patch Zlib.pm)

    - update Compress::Raw::Zlib to 2.023

    - update IO::Compress::Base, and IO::Compress::Zlib to       2.015 (#542645)

    - Mon Nov 30 2009 Marcela Maslaova <mmaslano at       redhat.com> - 4:5.10.0-86

    - 542645 update IO-Compress-Base

    - Tue Nov 24 2009 Stepan Kasal <skasal at redhat.com> -       4:5.10.0-85

    - back out perl-5.10.0-spamassassin.patch (#528572)

    - Thu Oct 1 2009 Chris Weyl <cweyl at alumni.drew.edu> -       4:5.10.0-84

    - add /perl(UNIVERSAL)/d; /perl(DB)/d to       perl_default_filter auto-provides filtering

  - Thu Oct 1 2009 Stepan Kasal <skasal at redhat.com> -     4:5.10.0-83

    - update Storable to 2.21

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2010-1168 perl Safe: Intended restriction bypass via object references CVE-2010-1447 perl: Safe restriction bypass when reference to subroutine in compartment is called from outside Perl leaked memory with ENV.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in Path.pm and Safe.pm which could lead to escalated privilegies (CVE-2008-5302, CVE-2008-5303, CVE-2010-1168, CVE-2010-1447). The updated packages have been patched to correct these issues.

Multiple vulnerabilities has been discovered and corrected in Safe.pm which could lead to escalated privilegies (CVE-2010-1168, CVE-2010-1447). The updated packages have been patched to correct these issues.

Updated perl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Perl is a high-level programming language commonly used for system administration utilities and web programming. The Safe extension module allows users to compile and execute Perl code in restricted compartments. The File::Path module allows users to create and remove directory trees.

The Safe module did not properly restrict the code of implicitly called methods (such as DESTROY and AUTOLOAD) on implicitly blessed objects returned as a result of unsafe code evaluation. These methods could have been executed unrestricted by Safe when such objects were accessed or destroyed. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions. (CVE-2010-1168)

The Safe module did not properly restrict code compiled in a Safe compartment and executed out of the compartment via a subroutine reference returned as a result of unsafe code evaluation. A specially crafted Perl script executed inside of a Safe compartment could use this flaw to bypass intended Safe module restrictions, if the returned subroutine reference was called from outside of the compartment.
(CVE-2010-1447)

Multiple race conditions were found in the way the File::Path module's rmtree function removed directory trees. A malicious, local user with write access to a directory being removed by a victim, running a Perl script using rmtree, could cause the permissions of arbitrary files to be changed to world-writable and setuid, or delete arbitrary files via a symbolic link attack, if the victim had the privileges to change the permissions of the target files or to remove them. (CVE-2008-5302, CVE-2008-5303)

Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1168 and CVE-2010-1447 issues. Upstream acknowledges Nick Cleaton as the original reporter of CVE-2010-1168, and Tim Bunce and Rafael Garcia-Suarez as the original reporters of CVE-2010-1447.

These packages upgrade the Safe extension module to version 2.27.
Refer to the Safe module's Changes file, linked to in the References, for a full list of changes.

Users of perl are advised to upgrade to these updated packages, which correct these issues. All applications using the Safe or File::Path modules must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0457 advisory.

    Perl is a high-level programming language commonly used for system     administration utilities and web programming. The Safe extension module     allows users to compile and execute Perl code in restricted compartments.

    The Safe module did not properly restrict the code of implicitly called     methods (such as DESTROY and AUTOLOAD) on implicitly blessed objects     returned as a result of unsafe code evaluation. These methods could have     been executed unrestricted by Safe when such objects were accessed or     destroyed. A specially-crafted Perl script executed inside of a Safe     compartment could use this flaw to bypass intended Safe module     restrictions. (CVE-2010-1168)

    The Safe module did not properly restrict code compiled in a Safe     compartment and executed out of the compartment via a subroutine reference     returned as a result of unsafe code evaluation. A specially-crafted Perl     script executed inside of a Safe compartment could use this flaw to bypass     intended Safe module restrictions, if the returned subroutine reference was     called from outside of the compartment. (CVE-2010-1447)

    Red Hat would like to thank Tim Bunce for responsibly reporting the     CVE-2010-1168 and CVE-2010-1447 issues. Upstream acknowledges Nick Cleaton     as the original reporter of CVE-2010-1168, and Tim Bunce and Rafal     Garcia-Suarez as the original reporters of CVE-2010-1447.

    These packages upgrade the Safe extension module to version 2.27. Refer to     the Safe module's Changes file, linked to in the References, for a full     list of changes.

    Users of perl are advised to upgrade to these updated packages, which     correct these issues. All applications using the Safe extension module must     be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted.

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server.
(CVE-2010-1169)

Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw.

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server.
(CVE-2010-1170)

A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442)

An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733)

PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136)

These packages upgrade PostgreSQL to version 8.1.21. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/8.1/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages, and are installed in trusted mode by default. In trusted mode, certain operations, such as operating system level access, are restricted.

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Perl. If the PL/Perl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Perl script could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server.
(CVE-2010-1169)

Red Hat would like to thank Tim Bunce for responsibly reporting the CVE-2010-1169 flaw.

A flaw was found in the way PostgreSQL enforced permission checks on scripts written in PL/Tcl. If the PL/Tcl procedural language was registered on a particular database, an authenticated database user running a specially crafted PL/Tcl script could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server.
(CVE-2010-1170)

A buffer overflow flaw was found in the way PostgreSQL retrieved a substring from the bit string for BIT() and BIT VARYING() SQL data types. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0442)

An integer overflow flaw was found in the way PostgreSQL used to calculate the size of the hash table for joined relations. An authenticated database user could create a specially crafted SQL query which could cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server. (CVE-2010-0733)

PostgreSQL improperly protected session-local state during the execution of an index function by a database superuser during the database maintenance operations. An authenticated database user could use this flaw to elevate their privileges via specially crafted index functions. (CVE-2009-4136)

These packages upgrade PostgreSQL to version 7.4.29. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

ID	Name	Product	Family	Severity
89741	VMware ESX Multiple Vulnerabilities (VMSA-2010-0013) (remote check)	Nessus	VMware ESX Local Security Checks	high
69872	Juniper NSM Servers < 2012.1 Multiple Vulnerabilities	Nessus	Misc.	high
68048	Oracle Linux 5 : perl (ELSA-2010-0458)	Nessus	Oracle Linux Local Security Checks	critical
68047	Oracle Linux 3 / 4 : perl (ELSA-2010-0457)	Nessus	Oracle Linux Local Security Checks	high
68043	Oracle Linux 4 : postgresql (ELSA-2010-0428)	Nessus	Oracle Linux Local Security Checks	high
60801	Scientific Linux Security Update : perl on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60800	Scientific Linux Security Update : perl on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
56626	GLSA-201110-22 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
55487	Debian DSA-2267-1 : perl - restriction bypass	Nessus	Debian Local Security Checks	high
55090	Ubuntu 6.06 LTS / 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : perl vulnerabilities (USN-1129-1)	Nessus	Ubuntu Local Security Checks	high
50956	SuSE 11 / 11.1 Security Update : Perl (SAT Patch Numbers 2833 / 2834)	Nessus	SuSE Local Security Checks	high
49914	SuSE 10 Security Update : Perl (ZYPP Patch Number 7108)	Nessus	SuSE Local Security Checks	high
49085	VMSA-2010-0013 : VMware ESX third-party updates for Service Console	Nessus	VMware ESX Local Security Checks	high
48429	SuSE9 Security Update : Perl (YOU Patch Number 12628)	Nessus	SuSE Local Security Checks	high
48373	openSUSE Security Update : perl (openSUSE-SU-2010:0518-1)	Nessus	SuSE Local Security Checks	high
48372	openSUSE Security Update : perl (openSUSE-SU-2010:0519-1)	Nessus	SuSE Local Security Checks	high
48324	Fedora 12 : perl-5.10.0-91.fc12 (2010-11340)	Nessus	Fedora Local Security Checks	high
48227	Fedora 13 : perl-5.10.1-116.fc13 (2010-11323)	Nessus	Fedora Local Security Checks	high
46878	Mandriva Linux Security Advisory : perl (MDVSA-2010:116)	Nessus	Mandriva Local Security Checks	high
46877	Mandriva Linux Security Advisory : perl (MDVSA-2010:115)	Nessus	Mandriva Local Security Checks	high
46874	CentOS 5 : perl (CESA-2010:0458)	Nessus	CentOS Local Security Checks	high
46834	RHEL 5 : perl (RHSA-2010:0458)	Nessus	Red Hat Local Security Checks	high
46833	RHEL 4 : perl (RHSA-2010:0457)	Nessus	Red Hat Local Security Checks	critical
46761	CentOS 5 : postgresql (CESA-2010:0429)	Nessus	CentOS Local Security Checks	high
46696	CentOS 4 : postgresql (CESA-2010:0428)	Nessus	CentOS Local Security Checks	high
46683	RHEL 5 : postgresql (RHSA-2010:0429)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-1447

critical

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high