The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.

PostgreSQL functions implemented in Perl or TCL shared a global state even across different user user ids. A user could therefore influence functions of other users in an unexpected or even malicious way (CVE-2010-3433).

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially vulnerable to multiple vulnerabilities, the worst of which may allow an authenticated user to trigger a denial of service condition or execute arbitrary code.

From Red Hat Security Advisory 2010:0742 :

Updated postgresql and postgresql84 packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages. The PostgreSQL SECURITY DEFINER parameter, which can be used when creating a new PostgreSQL function, specifies that the function will be executed with the privileges of the user that created it.

It was discovered that a user could utilize the features of the PL/Perl and PL/Tcl languages to modify the behavior of a SECURITY DEFINER function created by a different user. If the PL/Perl or PL/Tcl language was used to implement a SECURITY DEFINER function, an authenticated database user could use a PL/Perl or PL/Tcl script to modify the behavior of that function during subsequent calls in the same session. This would result in the modified or injected code also being executed with the privileges of the user who created the SECURITY DEFINER function, possibly leading to privilege escalation.
(CVE-2010-3433)

For Red Hat Enterprise Linux 4, the updated postgresql packages upgrade PostgreSQL to version 7.4.30. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html

For Red Hat Enterprise Linux 5, the updated postgresql packages upgrade PostgreSQL to version 8.1.22, and the updated postgresql84 packages upgrade PostgreSQL to version 8.4.5. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/8.1/static/release.html http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.

The version of PostgreSQL installed on the remote host is 7.4 prior to 7.4.30, 8.0 prior to 8.0.26, 8.1 prior to 8.1.22, 8.2 prior to 8.2.18, 8.3 prior to 8.3.12, 8.4 prior to 8.4.5, or 9.0 prior to 9.0.1.  It therefore is potentially affected by a privilege escalation vulnerability. 

A remote, authenticated attacker could elevate privileges via specially crafted code in a SECURITY DEFINER function.

It was discovered that a user could utilize the features of the PL/Perl andaPL/Tcl languages to modify the behavior of a SECURITY DEFINER functionacreated by a different user. If the PL/Perl or PL/Tcl language was used toaimplement a SECURITY DEFINER function, an authenticated database user couldause a PL/Perl or PL/Tcl script to modify the behavior of that functionaduring subsequent calls in the same session. This would result in theamodified or injected code also being executed with the privileges of theauser who created the SECURITY DEFINER function, possibly leading to privilege escalation.
(CVE-2010-3433)

These updated postgresql packages upgrade PostgreSQL to version 8.4.5.
Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

If the postgresql service is running, it will be automatically restarted after installing this update.

It was discovered that a user could utilize the features of the PL/Perl and PL/Tcl languages to modify the behavior of a SECURITY DEFINER function created by a different user. If the PL/Perl or PL/Tcl language was used to implement a SECURITY DEFINER function, an authenticated database user could use a PL/Perl or PL/Tcl script to modify the behavior of that function during subsequent calls in the same session. This would result in the modified or injected code also being executed with the privileges of the user who created the SECURITY DEFINER function, possibly leading to privilege escalation.
(CVE-2010-3433)

For Scientific Linux 4, the updated postgresql packages upgrade PostgreSQL to version 7.4.30.

For Scientific Linux 5, the updated postgresql packages upgrade PostgreSQL to version 8.1.22, and the updated postgresql84 packages upgrade PostgreSQL to version 8.4.5.

If the postgresql service is running, it will be automatically restarted after installing this update.

The remote host is affected by the vulnerability described in GLSA-201110-22 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote authenticated attacker could send a specially crafted SQL query       to a PostgreSQL server with the 'intarray' module enabled, possibly       resulting in the execution of arbitrary code with the privileges of the       PostgreSQL server process, or a Denial of Service condition. Furthermore,       a remote authenticated attacker could execute arbitrary Perl code, cause       a Denial of Service condition via different vectors, bypass LDAP       authentication, bypass X.509 certificate validation, gain database       privileges, exploit weak blowfish encryption and possibly cause other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

Updated postgresql packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages. The PostgreSQL SECURITY DEFINER parameter, which can be used when creating a new PostgreSQL function, specifies that the function will be executed with the privileges of the user that created it.

It was discovered that a user could utilize the features of the PL/Perl and PL/Tcl languages to modify the behavior of a SECURITY DEFINER function created by a different user. If the PL/Perl or PL/Tcl language was used to implement a SECURITY DEFINER function, an authenticated database user could use a PL/Perl or PL/Tcl script to modify the behavior of that function during subsequent calls in the same session. This would result in the modified or injected code also being executed with the privileges of the user who created the SECURITY DEFINER function, possibly leading to privilege escalation.
(CVE-2010-3433)

These updated postgresql packages upgrade PostgreSQL to version 8.4.5.
Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.

Upgrade base version to v9.0.1 which contains various bug and security fixes.

  -     http://www.postgresql.org/docs/9.0/static/release-9-0.ht     ml

    -       http://www.postgresql.org/docs/9.0/static/release-9-0-       1.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PostgreSQL functions implemented in Perl or TCL shared a global state even across different user user ids. A user could therefore influence functions of other users in an unexpected or even malicious way.
(CVE-2010-3433)

PostgreSQL was updated to version 8.1.22 which fixes the security issue.

Update to PostgreSQL 8.4.5, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-5.html including the fix for CVE-2010-3433

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tim Bunce discovered that PostgreSQL, a database server software, does not properly separate interpreters for server-side stored procedures which run in different security contexts. As a result, non-privileged authenticated database users might gain additional privileges.

Note that this security update may impact intended communication through global variables between stored procedures. It might be necessary to convert these functions to run under the plperlu or pltclu languages, with database superuser privileges.

This security update also includes unrelated bug fixes from PostgreSQL 8.3.12.

USN-1002-1 fixed vulnerabilities in PostgreSQL. This update provides the corresponding update for Ubuntu 10.10.

It was discovered that PostgreSQL did not properly enforce permissions within sessions when PL/Perl and PL/Tcl functions or operators were redefined. A remote authenticated attacker could exploit this to execute arbitrary code with permissions of a different user, possibly leading to privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that PostgreSQL did not properly enforce permissions within sessions when PL/Perl and PL/Tcl functions or operators were redefined. A remote authenticated attacker could exploit this to execute arbitrary code with permissions of a different user, possibly leading to privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated postgresql and postgresql84 packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS). PL/Perl and PL/Tcl allow users to write PostgreSQL functions in the Perl and Tcl languages. The PostgreSQL SECURITY DEFINER parameter, which can be used when creating a new PostgreSQL function, specifies that the function will be executed with the privileges of the user that created it.

It was discovered that a user could utilize the features of the PL/Perl and PL/Tcl languages to modify the behavior of a SECURITY DEFINER function created by a different user. If the PL/Perl or PL/Tcl language was used to implement a SECURITY DEFINER function, an authenticated database user could use a PL/Perl or PL/Tcl script to modify the behavior of that function during subsequent calls in the same session. This would result in the modified or injected code also being executed with the privileges of the user who created the SECURITY DEFINER function, possibly leading to privilege escalation.
(CVE-2010-3433)

For Red Hat Enterprise Linux 4, the updated postgresql packages upgrade PostgreSQL to version 7.4.30. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html

For Red Hat Enterprise Linux 5, the updated postgresql packages upgrade PostgreSQL to version 8.1.22, and the updated postgresql84 packages upgrade PostgreSQL to version 8.4.5. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/8.1/static/release.html http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.

Multiple vulnerabilities was discovered and corrected in postgresql :

An authenticated database user can manipulate modules and tied variables in some external procedural languages to execute code with enhanced privileges (CVE-2010-3433).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

This update provides a solution to these vulnerabilities.

ID	Name	Product	Family	Severity
75712	openSUSE Security Update : postgresql (openSUSE-SU-2010:0903-1)	Nessus	SuSE Local Security Checks	medium
69872	Juniper NSM Servers < 2012.1 Multiple Vulnerabilities	Nessus	Misc.	high
68109	Oracle Linux 4 / 5 : postgresql / postgresql84 (ELSA-2010-0742)	Nessus	Oracle Linux Local Security Checks	medium
63350	PostgreSQL 7.4 < 7.4.30 / 8.0 < 8.0.26 / 8.1 < 8.1.22 / 8.2 < 8.2.18 / 8.3 < 8.3.12 / 8.4 < 8.4.5 / 9.0 < 9.0.1	Nessus	Databases	medium
60906	Scientific Linux Security Update : postgresql on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60862	Scientific Linux Security Update : postgresql and postgresql84 on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56626	GLSA-201110-22 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50703	RHEL 6 : postgresql (RHSA-2010:0908)	Nessus	Red Hat Local Security Checks	medium
50390	Fedora 14 : sepostgresql-9.0.1-20101007.fc14 (2010-15870)	Nessus	Fedora Local Security Checks	high
50375	openSUSE Security Update : postgresql (openSUSE-SU-2010:0903-1)	Nessus	SuSE Local Security Checks	medium
50370	openSUSE Security Update : postgresql (openSUSE-SU-2010:0903-1)	Nessus	SuSE Local Security Checks	medium
50355	Fedora 13 : sepostgresql-9.0.1-20101007.fc13 (2010-16004)	Nessus	Fedora Local Security Checks	high
50043	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 7186)	Nessus	SuSE Local Security Checks	medium
50031	Fedora 13 : postgresql-8.4.5-1.fc13 (2010-15960)	Nessus	Fedora Local Security Checks	medium
50029	Fedora 12 : postgresql-8.4.5-1.fc12 (2010-15954)	Nessus	Fedora Local Security Checks	medium
50004	Fedora 14 : postgresql-8.4.5-1.fc14 (2010-15852)	Nessus	Fedora Local Security Checks	medium
49966	Debian DSA-2120-1 : postgresql-8.3 - privilege escalation	Nessus	Debian Local Security Checks	medium
49804	Ubuntu 10.10 : postgresql-8.4 vulnerability (USN-1002-2)	Nessus	Ubuntu Local Security Checks	medium
49803	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerability (USN-1002-1)	Nessus	Ubuntu Local Security Checks	medium
49785	RHEL 4 / 5 : postgresql and postgresql84 (RHSA-2010:0742)	Nessus	Red Hat Local Security Checks	medium
49784	Mandriva Linux Security Advisory : postgresql (MDVSA-2010:197)	Nessus	Mandriva Local Security Checks	medium
49781	CentOS 4 / 5 : postgresql / postgresql84 (CESA-2010:0742)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2010-3433

critical

Tenable Plugins

medium

high

medium

medium

medium

medium

high

medium

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium