PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler.

PostgreSQL was updated to the latest stable release 8.1.23, fixing various bugs and security issues.

The following security issues have been fixed :

  - CVE-2012-3488: This update fixes arbitrary read and     write of files via XSL functionality.

  - CVE-2012-2655: postgresql: denial of service (stack     exhaustion) via specially crafted SQL.

  - CVE-2011-2483: crypt_blowfish was mishandling 8 bit     characters.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This version upgrade of PostgreSQL fixes following issues :

  - Bugfix release 9.0.10 :

  - Fix planner's assignment of executor parameters, and fix     executor's rescan logic for CTE plan nodes.

  - Improve page-splitting decisions in GiST indexes.

  - Fix cascading privilege revoke to stop if privileges are     still held.

  - Improve error messages for Hot Standby misconfiguration     errors.

  - Fix handling of SIGFPE when PL/Perl is in use.

  - Prevent PL/Perl from crashing if a recursive PL/Perl     function is redefined while being executed.

  - Work around possible misoptimization in PL/Perl.

  - See also:
    http://www.postgresql.org/docs/9.0/static/release.html

  - Security and bugfix release 9.0.9 :

  - Prevent access to external files/URLs via contrib/xml2     (CVE-2012-3488, bnc#776523).

  - Prevent access to external files/URLs via XML entity     references (CVE-2012-3489, bnc#776524).

  - Fix incorrect password transformation in     contrib/pgcrypto (CVE-2012-2143, bnc#766799).

  - Ignore SECURITY DEFINER and SET attributes for a     procedural language's call handler (CVE-2012-2655,     bnc#765069).

  - See also:
    http://www.postgresql.org/docs/9.0/static/release.html

  - Rename postgresql-mkspecfiles to pre_checkin.sh

- Security and bugfix release 9.1.5 :

  - Ignore SECURITY DEFINER and SET attributes for a     procedural language's call handler (CVE-2012-2655)     bnc#765069

  - Fix incorrect password transformation in     'contrib/pgcrypto''s DES crypt() function     (CVE-2012-2143) bnc#766799

  - Prevent access to external files/URLs via     'contrib/xml2''s xslt_process() (CVE-2012-3488)     bnc#776523

  - Prevent access to external files/URLs via XML entity     references (CVE-2012-3489) bnc#776524

  - See the release notes for the rest of the changes:
    http://www.postgresql.org/docs/9.1/static/release.html     /usr/share/doc/packages/postgresql/HISTORY

A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143)

Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated.

A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language's (such as PL/Perl or PL/Python) call handler function. A non-superuser database owner could use this flaw to cause the PostgreSQL server to crash due to infinite recursion. (CVE-2012-2655)

From Red Hat Security Advisory 2012:1037 :

Updated postgresql84 and postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143)

Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated.

A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language's (such as PL/Perl or PL/Python) call handler function. A non-superuser database owner could use this flaw to cause the PostgreSQL server to crash due to infinite recursion. (CVE-2012-2655)

Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of the CVE-2012-2143 issue.

These updated packages upgrade PostgreSQL to version 8.4.12, which fixes these issues as well as several non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Versions of PostgreSQL earlier than 8.3.19/ 8.4.12 / 9.0.8 / 9.1.4 are potentially affected by multiple vulnerabilities. It therefore is affected by the following vulnerabilities : 

  - Passwords containing the byte 0x80 passed to the crypt() function in pgcrypto are incorrectly truncated if DES encryption was used. (CVE-2012-2143)

  - SECURITY_DEFINER and SET attributes on procedural call handlers are not ignored and can be used to crash the server. (CVE-2012-2655)

This update provides PostgreSQL 8.3.20. As part of this update, the packaging scheme has been changed to accomodate an optional parallel installation of newer PostgreSQL versions.

The changes in 8.3.20 are :

  - Prevent access to external files/URLs via XML entity     references. xml_parse() would attempt to fetch external     files or URLs as needed to resolve DTD and entity     references in an XML value, thus allowing unprivileged     database users to attempt to fetch data with the     privileges of the database server. (CVE-2012-3489,     bnc#776524)

  - Prevent access to external files/URLs via     'contrib/xml2''s xslt_process(). libxslt offers the     ability to read and write both files and URLs through     stylesheet commands, thus allowing unprivileged database     users to both read and write data with the privileges of     the database server. Disable that through proper use of     libxslt's security options. (CVE-2012-3488, bnc#776523).
    Also, remove xslt_process()'s ability to fetch documents     and stylesheets from external files/URLs.

  - Fix incorrect password transformation in     contrib/pgcrypto's DES crypt() function. If a password     string contained the byte value 0x80, the remainder of     the password was ignored, causing the password to be     much weaker than it appeared. With this fix, the rest of     the string is properly included in the DES hash. Any     stored password values that are affected by this bug     will thus no longer match, so the stored values may need     to be updated. (CVE-2012-2143)

  - Ignore SECURITY DEFINER and SET attributes for a     procedural language's call handler. Applying such     attributes to a call handler could crash the server.
    (CVE-2012-2655)

  - Allow numeric timezone offsets in timestamp input to be     up to 16 hours away from UTC. Some historical time zones     have offsets larger than 15 hours, the previous limit.
    This could result in dumped data values being rejected     during reload.

  - Fix timestamp conversion to cope when the given time is     exactly the last DST transition time for the current     timezone. This oversight has been there a long time, but     was not noticed previously because most DST-using zones     are presumed to have an indefinite sequence of future     DST transitions.

  - Fix text to name and char to name casts to perform     string truncation correctly in multibyte encodings.

  - Fix memory copying bug in to_tsquery().

  - Fix slow session startup when pg_attribute is very     large. If pg_attribute exceeds one-fourth of     shared_buffers, cache rebuilding code that is sometimes     needed during session start would trigger the     synchronized-scan logic, causing it to take many times     longer than normal. The problem was particularly acute     if many new sessions were starting at once.

  - Ensure sequential scans check for query cancel     reasonably often. A scan encountering many consecutive     pages that contain no live tuples would not respond to     interrupts meanwhile.

  - Show whole-row variables safely when printing views or     rules. Corner cases involving ambiguous names (that is,     the name could be either a table or column name of the     query) were printed in an ambiguous way, risking that     the view or rule would be interpreted differently after     dump and reload. Avoid the ambiguous case by attaching a     no-op cast.

  - Ensure autovacuum worker processes perform stack depth     checking properly. Previously, infinite recursion in a     function invoked by auto-ANALYZE could crash worker     processes.

  - Fix logging collector to not lose log coherency under     high load. The collector previously could fail to     reassemble large messages if it got too busy.

  - Fix logging collector to ensure it will restart file     rotation after receiving SIGHUP.

  - Fix PL/pgSQL's GET DIAGNOSTICS command when the target     is the function's first variable.

  - Fix several performance problems in pg_dump when the     database contains many objects. pg_dump could get very     slow if the database contained many schemas, or if many     objects are in dependency loops, or if there are many     owned sequences.

  - Fix contrib/dblink's dblink_exec() to not leak temporary     database connections upon error.

The version of PostgreSQL installed on the remote host is 8.3.x prior to 8.3.19, 8.4.x prior to 8.4.12, 9.0.x prior to 9.0.8, or 9.1.x prior to 9.1.4.  As such, it is potentially affected by multiple vulnerabilities :

  - Passwords containing the byte 0x80 passed to the crypt()     function in pgcrypto are incorrectly truncated if DES     encryption was used. (CVE-2012-2143)

  - SECURITY_DEFINER and SET attributes on procedural call     handlers are not ignored and can be used to crash the     server. (CVE-2012-2655)

PostgreSQL was updated to the latest stable release 8.1.23, fixing various bugs and security issues.

The following security issues have been fixed :

  - This update fixes arbitrary read and write of files via     XSL functionality. (CVE-2012-3488)

  - postgresql: denial of service (stack exhaustion) via     specially crafted SQL. (CVE-2012-2655)

  - crypt_blowfish was mishandling 8 bit characters.
    (CVE-2011-2483)

The remote host is affected by the vulnerability described in GLSA-201209-24 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could spoof SSL connections. Furthermore, a remote       authenticated attacker could cause a Denial of Service, read and write       arbitrary files, inject SQL commands into dump scripts, or bypass       database restrictions to execute database functions.
    A context-dependent attacker could more easily obtain access via       authentication attempts with an initial substring of the intended       password.
  Workaround :

    There is no known workaround at this time.

PostgreSQL is an advanced object-relational database management system (DBMS).

A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143)

Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated.

A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language's (such as PL/Perl or PL/Python) call handler function. A non-superuser database owner could use this flaw to cause the PostgreSQL server to crash due to infinite recursion. (CVE-2012-2655)

These updated packages upgrade PostgreSQL to version 8.4.12, which fixes these issues as well as several non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Two vulnerabilities were discovered in PostgreSQL, a SQL database server :

  - CVE-2012-2143     The crypt(text, text) function in the pgcrypto contrib     module did not handle certain passwords correctly when     producing traditional DES-based hashes. Characters after     the first 0x80 byte were ignored.

  - CVE-2012-2655     SECURITY DEFINER and SET attributes for a call handler     of a procedural language could crash the database     server.

In addition, this update contains reliability and stability fixes from the 8.4.12 upstream release.

Updated postgresql84 and postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

A flaw was found in the way the crypt() password hashing function from the optional PostgreSQL pgcrypto contrib module performed password transformation when used with the DES algorithm. If the password string to be hashed contained the 0x80 byte value, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. This made brute-force guessing more efficient as the whole password was not required to gain access to protected resources. (CVE-2012-2143)

Note: With this update, the rest of the string is properly included in the DES hash; therefore, any previously stored password values that are affected by this issue will no longer match. In such cases, it will be necessary for those stored password hashes to be updated.

A denial of service flaw was found in the way the PostgreSQL server performed a user privileges check when applying SECURITY DEFINER or SET attributes to a procedural language's (such as PL/Perl or PL/Python) call handler function. A non-superuser database owner could use this flaw to cause the PostgreSQL server to crash due to infinite recursion. (CVE-2012-2655)

Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of the CVE-2012-2143 issue.

These updated packages upgrade PostgreSQL to version 8.4.12, which fixes these issues as well as several non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1037 advisory.

  - BSD crypt(): DES encrypted password weakness (CVE-2012-2143)

  - postgresql: Ability of database owners to install procedural languages via CREATE LANGUAGE found unsafe     (DoS) (CVE-2012-2655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Upstream bug fix + security updates, including the fixes for CVE-2012-2143, CVE-2012-2655

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in postgresql :

Fix incorrect password transformation in contrib/pgcrypto's DES crypt() function (Solar Designer). If a password string contained the byte value 0x80, the remainder of the password was ignored, causing the password to be much weaker than it appeared. With this fix, the rest of the string is properly included in the DES hash. Any stored password values that are affected by this bug will thus no longer match, so the stored values may need to be updated (CVE-2012-2143).

Ignore SECURITY DEFINER and SET attributes for a procedural language's call handler (Tom Lane). Applying such attributes to a call handler could crash the server (CVE-2012-2655).

This advisory provides the latest versions of PostgreSQL that is not vulnerable to these issues.

It was discovered that PostgreSQL incorrectly handled certain bytes passed to the crypt() function when using DES encryption. An attacker could use this flaw to incorrectly handle authentication.
(CVE-2012-2143)

It was discovered that PostgreSQL incorrectly handled SECURITY DEFINER and SET attributes on procedural call handlers. An attacker could use this flaw to cause PostgreSQL to crash, leading to a denial of service. (CVE-2012-2655).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83561	SUSE SLED10 / SLES10 Security Update : PostgreSQL (SUSE-SU-2012:1336-1)	Nessus	SuSE Local Security Checks	medium
74773	openSUSE Security Update : postgresql (openSUSE-SU-2012:1299-1)	Nessus	SuSE Local Security Checks	medium
74769	openSUSE Security Update : postgresql / postgresql-libs (openSUSE-SU-2012:1288-1)	Nessus	SuSE Local Security Checks	medium
74766	openSUSE Security Update : postgresql / postgresql-libs (openSUSE-SU-2012:1251-1)	Nessus	SuSE Local Security Checks	medium
69701	Amazon Linux AMI : postgresql8 (ALAS-2012-94)	Nessus	Amazon Linux Local Security Checks	medium
68568	Oracle Linux 5 / 6 : postgresql / postgresql84 (ELSA-2012-1037)	Nessus	Oracle Linux Local Security Checks	medium
6816	PostgreSQL < 8.3.19 / 8.4.12 / 9.0.8 / 9.1.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
64216	SuSE 11.1 Security Update : PostgreSQL (SAT Patch Number 6697)	Nessus	SuSE Local Security Checks	medium
63353	PostgreSQL 8.3 < 8.3.19 / 8.4 < 8.4.12 / 9.0 < 9.0.8 / 9.1 < 9.1.4 Multiple Vulnerabilities	Nessus	Databases	high
62545	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 8311)	Nessus	SuSE Local Security Checks	medium
62380	GLSA-201209-24 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
61353	Scientific Linux Security Update : postgresql and postgresql84 on SL6.x i386/x86_64 (20120625)	Nessus	Scientific Linux Local Security Checks	medium
61352	Scientific Linux Security Update : postgresql and postgresql84 on SL5.x i386/x86_64 (20120625)	Nessus	Scientific Linux Local Security Checks	medium
59769	Debian DSA-2491-1 : postgresql-8.4 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
59719	CentOS 5 / 6 : postgresql / postgresql84 (CESA-2012:1037)	Nessus	CentOS Local Security Checks	medium
59712	RHEL 5 / 6 : postgresql and postgresql84 (RHSA-2012:1037)	Nessus	Red Hat Local Security Checks	critical
59539	Fedora 17 : postgresql-9.1.4-1.fc17 (2012-8924)	Nessus	Fedora Local Security Checks	medium
59538	Fedora 15 : postgresql-9.0.8-1.fc15 (2012-8915)	Nessus	Fedora Local Security Checks	medium
59534	Fedora 16 : postgresql-9.1.4-1.fc16 (2012-8893)	Nessus	Fedora Local Security Checks	medium
59518	Mandriva Linux Security Advisory : postgresql (MDVSA-2012:092)	Nessus	Mandriva Local Security Checks	medium
59385	Ubuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1461-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-2655

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium