The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_headers module that allows HTTP     trailers to replace HTTP headers late during request     processing. A remote attacker can exploit this to inject     arbitrary headers. This can also cause some modules to     function incorrectly or appear to function incorrectly.
    (CVE-2013-5704)

  - A privilege escalation vulnerability exists due to the     'make check' command not properly invoking initdb to     specify authentication requirements for a database     cluster to be used for tests. A local attacker can     exploit this issue to gain temporary server access and     elevated privileges. (CVE-2014-0067)

  - A NULL pointer dereference flaw exists in module     mod_cache. A remote attacker, using an empty HTTP     Content-Type header, can exploit this vulnerability to     crash a caching forward proxy configuration, resulting     in a denial of service if using a threaded MPM.
    (CVE-2014-3581)

  - A out-of-bounds memory read flaw exists in module     mod_proxy_fcgi. An attacker, using a remote FastCGI     server to send long response headers, can exploit this     vulnerability to cause a denial of service by causing     a buffer over-read. (CVE-2014-3583)

  - A flaw exists in module mod_lua when handling a     LuaAuthzProvider used in multiple Require directives     with different arguments. An attacker can exploit this     vulnerability to bypass intended access restrictions.
    (CVE-2014-8109)

  - An information disclosure vulnerability exists due to     improper handling of restricted column values in     constraint-violation error messages. An authenticated,     remote attacker can exploit this to gain access to     sensitive information. (CVE-2014-8161)

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A flaw exists in the lua_websocket_read() function in     the 'mod_lua' module due to incorrect handling of     WebSocket PING frames. A remote attacker can exploit     this, by sending a crafted WebSocket PING frame after a     Lua script has called the wsupgrade() function, to crash     a child process, resulting in a denial of service     condition. (CVE-2015-0228)

  - Multiple vulnerabilities exist due to several buffer     overflow errors related to the 'to_char' functions. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0241)

  - Multiple vulnerabilities exist due to several     stack-based buffer overflow errors in various *printf()     functions. The overflows are due to improper validation     of user-supplied input when formatting a floating point     number where the requested precision is greater than     approximately 500. An authenticated, remote attacker     can exploit these issues to cause a denial of service or     arbitrary code execution. (CVE-2015-0242)

  - Multiple vulnerabilities exist due to an overflow     condition in multiple functions in the 'pgcrypto'     extension. The overflows are due to improper validation     of user-supplied input when tracking memory sizes. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0243)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input when handling     crafted binary data within a command parameter. An     authenticated, remote attacker can exploit this issue     to inject or manipulate SQL queries, allowing the     manipulation or disclosure of arbitrary data.
    (CVE-2015-0244)

  - A NULL pointer dereference flaw exists in the     read_request_line() function due to a failure to     initialize the protocol structure member. A remote     attacker can exploit this flaw, on installations that     enable the INCLUDES filter and has an ErrorDocument 400     directive specifying a local URI, by sending a request     that lacks a method, to cause a denial of service     condition. (CVE-2015-0253)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - A flaw exists in PostgreSQL client disconnect timeout     expiration that is triggered when a timeout interrupt     is fired partway through the session shutdown sequence.     (CVE-2015-3165)

  - A flaw exists in the printf() functions due to a failure     to check for errors. A remote attacker can use this to     gain access to sensitive information. (CVE-2015-3166)

  - The pgcrypto component in PostgreSQL has multiple error     messages for decryption with an incorrect key. A remote     attacker can use this to recover keys from other     systems. (CVE-2015-3167)

  - A flaw exists in the chunked transfer coding     implementation due to a failure to properly parse chunk     headers. A remote attacker can exploit this to conduct     HTTP request smuggling attacks. (CVE-2015-3183)

  - A flaw exists in the ap_some_auth_required() function     due to a failure to consider that a Require directive     may be associated with an authorization setting rather     than an authentication setting. A remote attacker can     exploit this, if a module that relies on the 2.2 API     behavior exists, to bypass intended access restrictions.
    (CVE-2015-3185)

  - Multiple unspecified XML flaws exist in the Wiki Server     based on Twisted. (CVE-2015-5911)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - CoreText
  - FontParser
  - Libinfo
  - libxml2
  - OpenSSL
  - perl
  - PostgreSQL
  - QL Office
  - Quartz Composer Framework
  - QuickTime 7
  - SceneKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.19, 9.1.x prior to 9.1.15, 9.2.x prior to 9.2.10, 9.3.x prior to 9.3.6, or 9.4.x prior to 9.4.1 and is affected by multiple vulnerabilities :

 - A privilege escalation vulnerability exists due to the 'make check' command not properly invoking initdb to specify authentication requirements for a database cluster to be used for tests. (CVE-2014-0067)

 - An information disclosure vulnerability exists due to improper handling of restricted column values in constraint-violation error messages. (CVE-2014-8161)

 - Multiple vulnerabilities exist due to several buffer overflow errors related to the 'to_char' functions. (CVE-2015-0241)

 - Multiple vulnerabilities exist due to several stack-based buffer overflow errors in various '*printf()' functions. The overflows are due to improper validation of user-supplied input when formatting a floating point number where the requested precision is greater than approximately 500. (CVE-2015-0242)

 - Multiple vulnerabilities exist due to an overflow condition in multiple functions in the 'pgcrypto' extension. The overflows are due to improper validation of user-supplied input when tracking memory sizes. (CVE-2015-0243)

 - A SQL injection vulnerability exists due to improper sanitization of user-supplied input when handling crafted binary data within a command parameter.(CVE-2015-0244)

Updated postgresql packages fix multiple security vulnerabilities :

Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions (CVE-2014-0060).

The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function.
Non-core procedural languages will also need to make this change to their own validator functions, if any (CVE-2014-0061).

If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack (CVE-2014-0062).

The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out().
Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name.
The ecpg library contained these vulnerabilities along with some of its own (CVE-2014-0063).

Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past (CVE-2014-0064).

Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type (CVE-2014-0065).

There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., FIPS mode) (CVE-2014-0066).

Since the temporary server started by make check uses trust authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine (CVE-2014-0067).

A user with limited clearance on a table might have access to information in columns without SELECT rights on through server error messages (CVE-2014-8161).

The function to_char() might read/write past the end of a buffer. This might crash the server when a formatting template is processed (CVE-2015-0241).

The pgcrypto module is vulnerable to stack buffer overrun that might crash the server (CVE-2015-0243).

Emil Lenngren reported that an attacker can inject SQL commands when the synchronization between client and server is lost (CVE-2015-0244).

This update provides PostgreSQL versions 9.3.6 and 9.2.10 that fix these issues, as well as several others.

New upstream minor release. Users should upgrade to this version at their next scheduled maintenance window.

Noteworthy change :

Secure Unix-domain sockets of temporary postmasters started during make check (Noah Misch)

Any local user able to access the socket file could connect as the server's bootstrap superuser, then proceed to execute arbitrary code as the operating-system user running the test, as we previously noted in CVE-2014-0067. This change defends against that risk by placing the server's socket in a temporary, mode 0700 subdirectory of /tmp.

8.4.22 marks the end of life of the PostgreSQL 8.4 branch. No further releases will be made by the PostgreSQL Global Development Group.

Users of PostgreSQL 8.4 should look into upgrading to a newer PostgreSQL release. Options are :

  - Upgrading to Debian 7 (Wheezy), providing     postgresql-9.1.

  - The use of the apt.postgresql.org repository, providing     packages for all active PostgreSQL branches (9.0 up to     9.4 at the time of writing).

    See https://wiki.postgresql.org/wiki/Apt for more     information about the repository.

    A helper script to activate the repository is provided     in     /usr/share/doc/postgresql-8.4/examples/apt.postgresql.or     g.sh.

  - An LTS version of 8.4 is in planning that will cover the     lifetime of squeeze-lts. Updates will probably made on a     best-effort basis. Users can take advantage of this, but     should still consider upgrading to newer PostgreSQL     versions over the next months.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow flaw was found in the way PostgreSQL handled certain numeric formatting. An authenticated database user could use a specially crafted timestamp formatting template to cause PostgreSQL to crash or, under certain conditions, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0241)

A buffer overflow flaw was found in the PostgreSQL's internal printf() implementation. An authenticated database user could use a specially crafted string in a SQL query to cause PostgreSQL to crash or, potentially, lead to privilege escalation. (CVE-2015-0242)

A stack-buffer overflow flaw was found in PostgreSQL's pgcrypto module. An authenticated database user could use this flaw to cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2015-0243)

A flaw was found in way PostgreSQL handled certain errors during that were generated during protocol synchronization. An authenticated database user could use this flaw to inject queries into an existing connection. (CVE-2015-0244)

The 'make check' command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to be used for the tests, which allows local users to gain privileges by leveraging access to this cluster. (CVE-2014-0067)

An information leak flaw was found in the way certain the PostgreSQL database server handled certain error messages. An authenticated database user could possibly obtain the results of a query they did not have privileges to execute by observing the constraint violation error messages produced when the query was executed. (CVE-2014-8161)

The version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.19, 9.1.x prior to 9.1.15, 9.2.x prior to 9.2.10, 9.3.x prior to 9.3.6, or 9.4.x prior to 9.4.1. It is, therefore, affected by multiple vulnerabilities :

  - A privilege escalation vulnerability exists due to the     'make check' command not properly invoking initdb to     specify authentication requirements for a database     cluster to be used for tests. A local attacker can     exploit this issue to gain temporary server access and     elevated privileges. Note that this issue only affects     Microsoft Windows hosts. (CVE-2014-0067)

  - An information disclosure vulnerability exists due to     improper handling of restricted column values in     constraint-violation error messages. An authenticated,     remote attacker can exploit this to gain access to     sensitive information. (CVE-2014-8161)

  - Multiple vulnerabilities exist due to several buffer     overflow errors related to the 'to_char' functions. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0241)

  - Multiple vulnerabilities exist due to several     stack-based buffer overflow errors in various *printf()     functions. The overflows are due to improper validation     of user-supplied input when formatting a floating point     number where the requested precision is greater than     approximately 500. An authenticated, remote attacker     can exploit these issues to cause a denial of service or     arbitrary code execution. (CVE-2015-0242)

  - Multiple vulnerabilities exist due to an overflow     condition in multiple functions in the 'pgcrypto'     extension. The overflows are due to improper validation     of user-supplied input when tracking memory sizes. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0243)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input when handling     crafted binary data within a command parameter. An     authenticated, remote attacker can exploit this issue     to inject or manipulate SQL queries, allowing the     manipulation or disclosure of arbitrary data.
    (CVE-2015-0244)

The PostgreSQL database was updated to the security and bugfix release 9.2.7, which following fixes :

  - Shore up GRANT ... WITH ADMIN OPTION restrictions     (CVE-2014-0060, bnc#864845)

  - Prevent privilege escalation via manual calls to PL     validator functions (CVE-2014-0061, bnc#864846)

  - Avoid multiple name lookups during table and index DDL     (CVE-2014-0062, bnc#864847)

  - Prevent buffer overrun with long datetime strings     (CVE-2014-0063, bnc#864850)

  - Prevent buffer overrun due to integer overflow in size     calculations (CVE-2014-0064, bnc#864851)

  - Prevent overruns of fixed-size buffers (CVE-2014-0065,     bnc#864852)

  - Avoid crashing if crypt() returns NULL (CVE-2014-0066,     bnc#864853)

  - Document risks of make check in the regression testing     instructions (CVE-2014-0067)

  - For the other (many!) bug fixes, see the release notes:
    http://www.postgresql.org/docs/9.3/static/release-9-2-7.
    html

The PostgreSQL database server was updated to version 9.1.12 to fix various security issues :

  - Granting a role without ADMIN OPTION is supposed to     prevent the grantee from adding or removing members from     the granted role, but this restriction was easily     bypassed by doing SET ROLE first. The security impact is     mostly that a role member can revoke the access of     others, contrary to the wishes of his grantor.
    Unapproved role member additions are a lesser concern,     since an uncooperative role member could provide most of     his rights to others anyway by creating views or     SECURITY DEFINER functions. (CVE-2014-0060)

  - The primary role of PL validator functions is to be     called implicitly during CREATE FUNCTION, but they are     also normal SQL functions that a user can call     explicitly. Calling a validator on a function actually     written in some other language was not checked for and     could be exploited for privilege-escalation purposes.
    The fix involves adding a call to a privilege-checking     function in each validator function. Non-core procedural     languages will also need to make this change to their     own validator functions, if any. (CVE-2014-0061)

  - If the name lookups come to different conclusions due to     concurrent activity, we might perform some parts of the     DDL on a different table than other parts. At least in     the case of CREATE INDEX, this can be used to cause the     permissions checks to be performed against a different     table than the index creation, allowing for a privilege     escalation attack. (CVE-2014-0062)

  - The MAXDATELEN constant was too small for the longest     possible value of type interval, allowing a buffer     overrun in interval_out(). Although the datetime input     functions were more careful about avoiding buffer     overrun, the limit was short enough to cause them to     reject some valid inputs, such as input containing a     very long timezone name. The ecpg library contained     these vulnerabilities along with some of its own.
    (CVE-2014-0063)

  - Several functions, mostly type input functions,     calculated an allocation size without checking for     overflow. If overflow did occur, a too-small buffer     would be allocated and then written past.
    (CVE-2014-0064)

  - Use strlcpy() and related functions to provide a clear     guarantee that fixed-size buffers are not overrun.
    Unlike the preceding items, it is unclear whether these     cases really represent live issues, since in most cases     there appear to be previous constraints on the size of     the input string. Nonetheless it seems prudent to     silence all Coverity warnings of this type.
    (CVE-2014-0065)

  - There are relatively few scenarios in which crypt()     could return NULL, but contrib/chkpass would crash if it     did. One practical case in which this could be an issue     is if libc is configured to refuse to execute unapproved     hashing algorithms (e.g., 'FIPS mode'). (CVE-2014-0066)

  - Since the temporary server started by make check uses     'trust' authentication, another user on the same machine     could connect to it as database superuser, and then     potentially exploit the privileges of the     operating-system user who started the tests. A future     release will probably incorporate changes in the testing     procedure to prevent this risk, but some public     discussion is needed first. So for the moment, just warn     people against using make check when there are untrusted     users on the same machine. (CVE-2014-0067)

The complete list of bugs and more information can be found at:
http://www.postgresql.org/docs/9.1/static/release-9-1-12.html

Multiple vulnerabilities has been discovered and corrected in postgresql :

Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role member can revoke the access of others, contrary to the wishes of his grantor. Unapproved role member additions are a lesser concern, since an uncooperative role member could provide most of his rights to others anyway by creating views or SECURITY DEFINER functions (CVE-2014-0060).

The primary role of PL validator functions is to be called implicitly during CREATE FUNCTION, but they are also normal SQL functions that a user can call explicitly. Calling a validator on a function actually written in some other language was not checked for and could be exploited for privilege-escalation purposes. The fix involves adding a call to a privilege-checking function in each validator function.
Non-core procedural languages will also need to make this change to their own validator functions, if any (CVE-2014-0061).

If the name lookups come to different conclusions due to concurrent activity, we might perform some parts of the DDL on a different table than other parts. At least in the case of CREATE INDEX, this can be used to cause the permissions checks to be performed against a different table than the index creation, allowing for a privilege escalation attack (CVE-2014-0062).

The MAXDATELEN constant was too small for the longest possible value of type interval, allowing a buffer overrun in interval_out().
Although the datetime input functions were more careful about avoiding buffer overrun, the limit was short enough to cause them to reject some valid inputs, such as input containing a very long timezone name.
The ecpg library contained these vulnerabilities along with some of its own (CVE-2014-0063).

Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past (CVE-2014-0064).

Use strlcpy() and related functions to provide a clear guarantee that fixed-size buffers are not overrun. Unlike the preceding items, it is unclear whether these cases really represent live issues, since in most cases there appear to be previous constraints on the size of the input string. Nonetheless it seems prudent to silence all Coverity warnings of this type (CVE-2014-0065).

There are relatively few scenarios in which crypt() could return NULL, but contrib/chkpass would crash if it did. One practical case in which this could be an issue is if libc is configured to refuse to execute unapproved hashing algorithms (e.g., FIPS mode) (CVE-2014-0066).

Since the temporary server started by make check uses trust authentication, another user on the same machine could connect to it as database superuser, and then potentially exploit the privileges of the operating-system user who started the tests. A future release will probably incorporate changes in the testing procedure to prevent this risk, but some public discussion is needed first. So for the moment, just warn people against using make check when there are untrusted users on the same machine (CVE-2014-0067).

This advisory provides the latest version of PostgreSQL that is not vulnerable to these issues.

PostgreSQL Project reports :

This update fixes CVE-2014-0060, in which PostgreSQL did not properly enforce the WITH ADMIN OPTION permission for ROLE management. Before this fix, any member of a ROLE was able to grant others access to the same ROLE regardless if the member was given the WITH ADMIN OPTION permission. It also fixes multiple privilege escalation issues, including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, and CVE-2014-0066. More information on these issues can be found on our security page and the security issue detail wiki page.

With this release, we are also alerting users to a known security hole that allows other users on the same machine to gain access to an operating system account while it is doing 'make check' :
CVE-2014-0067. 'Make check' is normally part of building PostgreSQL from source code. As it is not possible to fix this issue without causing significant issues to our testing infrastructure, a patch will be released separately and publicly. Until then, users are strongly advised not to run 'make check' on machines where untrusted users have accounts.

Various vulnerabilities were discovered in PostgreSQL :

  - CVE-2014-0060 Shore up GRANT ... WITH ADMIN OPTION     restrictions (Noah Misch)     Granting a role without ADMIN OPTION is supposed to     prevent the grantee from adding or removing members from     the granted role, but this restriction was easily     bypassed by doing SET ROLE first. The security impact is     mostly that a role member can revoke the access of     others, contrary to the wishes of his grantor.
    Unapproved role member additions are a lesser concern,     since an uncooperative role member could provide most of     his rights to others anyway by creating views or     SECURITY DEFINER functions.

  - CVE-2014-0061 Prevent privilege escalation via manual     calls to PL validator functions (Andres Freund)

    The primary role of PL validator functions is to be     called implicitly during CREATE FUNCTION, but they are     also normal SQL functions that a user can call     explicitly. Calling a validator on a function actually     written in some other language was not checked for and     could be exploited for privilege-escalation purposes.
    The fix involves adding a call to a privilege-checking     function in each validator function. Non-core procedural     languages will also need to make this change to their     own validator functions, if any.

  - CVE-2014-0062 Avoid multiple name lookups during table     and index DDL (Robert Haas, Andres Freund)

    If the name lookups come to different conclusions due to     concurrent activity, we might perform some parts of the     DDL on a different table than other parts. At least in     the case of CREATE INDEX, this can be used to cause the     permissions checks to be performed against a different     table than the index creation, allowing for a privilege     escalation attack.

  - CVE-2014-0063 Prevent buffer overrun with long datetime     strings (Noah Misch)

    The MAXDATELEN constant was too small for the longest     possible value of type interval, allowing a buffer     overrun in interval_out(). Although the datetime input     functions were more careful about avoiding buffer     overrun, the limit was short enough to cause them to     reject some valid inputs, such as input containing a     very long timezone name. The ecpg library contained     these vulnerabilities along with some of its own.

  - CVE-2014-0064 CVE-2014-2669 Prevent buffer overrun due     to integer overflow in size calculations (Noah Misch,     Heikki Linnakangas)

    Several functions, mostly type input functions,     calculated an allocation size without checking for     overflow. If overflow did occur, a too-small buffer     would be allocated and then written past.

  - CVE-2014-0065 Prevent overruns of fixed-size buffers     (Peter Eisentraut, Jozef Mlich)

    Use strlcpy() and related functions to provide a clear     guarantee that fixed-size buffers are not overrun.
    Unlike the preceding items, it is unclear whether these     cases really represent live issues, since in most cases     there appear to be previous constraints on the size of     the input string. Nonetheless it seems prudent to     silence all Coverity warnings of this type.

  - CVE-2014-0066 Avoid crashing if crypt() returns NULL     (Honza Horak, Bruce Momjian)

    There are relatively few scenarios in which crypt()     could return NULL, but contrib/chkpass would crash if it     did. One practical case in which this could be an issue     is if libc is configured to refuse to execute unapproved     hashing algorithms (e.g., 'FIPS mode').

  - CVE-2014-0067 Document risks of make check in the     regression testing instructions (Noah Misch, Tom Lane)

    Since the temporary server started by make check uses     'trust' authentication, another user on the same machine     could connect to it as database superuser, and then     potentially exploit the privileges of the     operating-system user who started the tests. A future     release will probably incorporate changes in the testing     procedure to prevent this risk, but some public     discussion is needed first. So for the moment, just warn     people against using make check when there are untrusted     users on the same machine.

Various vulnerabilities were discovered in PostgreSQL :

  - CVE-2014-0060 Shore up GRANT ... WITH ADMIN OPTION     restrictions (Noah Misch)     Granting a role without ADMIN OPTION is supposed to     prevent the grantee from adding or removing members from     the granted role, but this restriction was easily     bypassed by doing SET ROLE first. The security impact is     mostly that a role member can revoke the access of     others, contrary to the wishes of his grantor.
    Unapproved role member additions are a lesser concern,     since an uncooperative role member could provide most of     his rights to others anyway by creating views or     SECURITY DEFINER functions.

  - CVE-2014-0061 Prevent privilege escalation via manual     calls to PL validator functions (Andres Freund)

    The primary role of PL validator functions is to be     called implicitly during CREATE FUNCTION, but they are     also normal SQL functions that a user can call     explicitly. Calling a validator on a function actually     written in some other language was not checked for and     could be exploited for privilege-escalation purposes.
    The fix involves adding a call to a privilege-checking     function in each validator function. Non-core procedural     languages will also need to make this change to their     own validator functions, if any.

  - CVE-2014-0062 Avoid multiple name lookups during table     and index DDL (Robert Haas, Andres Freund)

    If the name lookups come to different conclusions due to     concurrent activity, we might perform some parts of the     DDL on a different table than other parts. At least in     the case of CREATE INDEX, this can be used to cause the     permissions checks to be performed against a different     table than the index creation, allowing for a privilege     escalation attack.

  - CVE-2014-0063 Prevent buffer overrun with long datetime     strings (Noah Misch)

    The MAXDATELEN constant was too small for the longest     possible value of type interval, allowing a buffer     overrun in interval_out(). Although the datetime input     functions were more careful about avoiding buffer     overrun, the limit was short enough to cause them to     reject some valid inputs, such as input containing a     very long timezone name. The ecpg library contained     these vulnerabilities along with some of its own.

  - CVE-2014-0064 Prevent buffer overrun due to integer     overflow in size calculations (Noah Misch, Heikki     Linnakangas)

    Several functions, mostly type input functions,     calculated an allocation size without checking for     overflow. If overflow did occur, a too-small buffer     would be allocated and then written past.

  - CVE-2014-0065 Prevent overruns of fixed-size buffers     (Peter Eisentraut, Jozef Mlich)

    Use strlcpy() and related functions to provide a clear     guarantee that fixed-size buffers are not overrun.
    Unlike the preceding items, it is unclear whether these     cases really represent live issues, since in most cases     there appear to be previous constraints on the size of     the input string. Nonetheless it seems prudent to     silence all Coverity warnings of this type.

  - CVE-2014-0066 Avoid crashing if crypt() returns NULL     (Honza Horak, Bruce Momjian)

    There are relatively few scenarios in which crypt()     could return NULL, but contrib/chkpass would crash if it     did. One practical case in which this could be an issue     is if libc is configured to refuse to execute unapproved     hashing algorithms (e.g., 'FIPS mode').

  - CVE-2014-0067 Document risks of make check in the     regression testing instructions (Noah Misch, Tom Lane)

    Since the temporary server started by make check uses     'trust' authentication, another user on the same machine     could connect to it as database superuser, and then     potentially exploit the privileges of the     operating-system user who started the tests. A future     release will probably incorporate changes in the testing     procedure to prevent this risk, but some public     discussion is needed first. So for the moment, just warn     people against using make check when there are untrusted     users on the same machine.

ID	Name	Product	Family	Severity
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
86066	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
85409	Mac OS X Multiple Vulnerabilities (Security Update 2015-006)	Nessus	MacOS X Local Security Checks	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
8727	PostgreSQL 9.0 < 9.0.19 / 9.1 < 9.1.15 / 9.2 < 9.2.10 / 9.3 < 9.3.6 / 9.4 < 9.4.1 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
82363	Mandriva Linux Security Advisory : postgresql (MDVSA-2015:110)	Nessus	Mandriva Local Security Checks	medium
82167	Debian DLA-19-1 : postgresql-8.4 update	Nessus	Debian Local Security Checks	medium
81828	Amazon Linux AMI : postgresql92 (ALAS-2015-492)	Nessus	Amazon Linux Local Security Checks	critical
81300	PostgreSQL 9.0 < 9.0.19 / 9.1 < 9.1.15 / 9.2 < 9.2.10 / 9.3 < 9.3.6 / 9.4 < 9.4.1 Multiple Vulnerabilities	Nessus	Databases	high
75281	openSUSE Security Update : postgresql92 (openSUSE-SU-2014:0345-1)	Nessus	SuSE Local Security Checks	medium
73268	SuSE 11.3 Security Update : PostgreSQL 9.1 (SAT Patch Number 8970)	Nessus	SuSE Local Security Checks	medium
72642	Mandriva Linux Security Advisory : postgresql (MDVSA-2014:047)	Nessus	Mandriva Local Security Checks	medium
72612	FreeBSD : PostgreSQL -- multiple privilege issues (42d42090-9a4d-11e3-b029-08002798f6ff)	Nessus	FreeBSD Local Security Checks	medium
72611	Debian DSA-2865-1 : postgresql-9.1 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
72610	Debian DSA-2864-1 : postgresql-8.4 - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-0067

high

Tenable Plugins

high

critical

high

high

high

medium

medium

critical

high

medium

medium

medium

medium

medium

medium