PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.

The PostgreSQL project reports :

Security Fixes nested CASE expressions + database and role names with embedded special characters

- CVE-2017-7484: selectivity estimators bypass SELECT privilege checks.

- CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable

- CVE-2017-7486: pg_user_mappings view discloses foreign server passwords. This applies to new databases, see the release notes for the procedure to apply the fix to an existing database.

According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way PostgreSQL server handled     certain SQL statements containing CASE/WHEN commands. A     remote, authenticated attacker could use a specially     crafted SQL statement to cause PostgreSQL to crash or     disclose a few bytes of server memory or possibly     execute arbitrary code.(CVE-2016-5423)

  - A flaw was found in the way PostgreSQL client programs     handled database and role names containing newlines,     carriage returns, double quotes, or backslashes. By     crafting such an object name, roles with the CREATEDB     or CREATEROLE option could escalate their privileges to     superuser when a superuser next executes maintenance     with a vulnerable client program.(CVE-2016-5424i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql93 to version 9.3.14 fixes the several issues.

These security issues were fixed :

  - CVE-2016-5423: CASE/WHEN with inlining can cause     untrusted pointer dereference (bsc#993454).

  - CVE-2016-5424: Fix client programs' handling of special     characters in database and role names (bsc#993453).

This non-security issue was fixed :

  - bsc#973660: Added 'Requires: timezone' to Service Pack

  - bsc#1029547: postgresql: fails to build with timezone     2017a 

For additional non-security issues please refer to

- http://www.postgresql.org/docs/9.3/static/release-9-3-14.html

- http://www.postgresql.org/docs/9.3/static/release-9-3-13.html

- http://www.postgresql.org/docs/9.4/static/release-9-3-12.html 

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is affected by the vulnerability described in GLSA-201701-33 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or       escalate privileges.
  Workaround :

    There is no known workaround at this time.

The following packages have been upgraded to a newer upstream version:
postgresql (9.2.18).

Security Fix(es) :

  - A flaw was found in the way PostgreSQL server handled     certain SQL statements containing CASE/WHEN commands. A     remote, authenticated attacker could use a specially     crafted SQL statement to cause PostgreSQL to crash or     disclose a few bytes of server memory or possibly     execute arbitrary code. (CVE-2016-5423)

  - A flaw was found in the way PostgreSQL client programs     handled database and role names containing newlines,     carriage returns, double quotes, or backslashes. By     crafting such an object name, roles with the CREATEDB or     CREATEROLE option could escalate their privileges to     superuser when a superuser next executes maintenance     with a vulnerable client program. (CVE-2016-5424)

Additional Changes :

An update for postgresql is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a newer upstream version:
postgresql (9.2.18).

Security Fix(es) :

* A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423)

* A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Heikki Linnakangas as the original reporter of CVE-2016-5423; and Nathan Bossart as the original reporter of CVE-2016-5424.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Update to version 9.5.4 per release notes, includes security fixes for CVE-2016-5423 and CVE-2016-5424

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2016:2606 :

An update for postgresql is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The following packages have been upgraded to a newer upstream version:
postgresql (9.2.18).

Security Fix(es) :

* A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423)

* A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424)

Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Heikki Linnakangas as the original reporter of CVE-2016-5423; and Nathan Bossart as the original reporter of CVE-2016-5424.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

This update for postgresql94 to version 9.4.9 fixes the several issues.

These security issues were fixed :

  - CVE-2016-5423: CASE/WHEN with inlining can cause     untrusted pointer dereference (bsc#993454).

  - CVE-2016-5424: Fix client programs' handling of special     characters in database and role names (bsc#993453).

This non-security issue was fixed :

  - bsc#973660: Added 'Requires: timezone' to Service Pack

For additional non-security issues please refer to

- http://www.postgresql.org/docs/9.4/static/release-9-4-9.html

- http://www.postgresql.org/docs/9.4/static/release-9-4-8.html

- http://www.postgresql.org/docs/9.4/static/release-9-4-7.html

This update was imported from the SUSE:SLE-12:Update update project.

The postgresql server postgresql93 was updated to 9.3.14 fixes the following issues :

Update to version 9.3.14 :

  - Fix possible mis-evaluation of nested CASE-WHEN     expressions (CVE-2016-5423, boo#993454)

  - Fix client programs' handling of special characters in     database and role names (CVE-2016-5424, boo#993453)

  - Fix corner-case misbehaviors for IS NULL/IS NOT NULL     applied to nested composite values

  - Make the inet and cidr data types properly reject IPv6     addresses with too many colon-separated fields

  - Prevent crash in close_ps() (the point ## lseg operator)     for NaN input coordinates

  - Fix several one-byte buffer over-reads in to_number()

  - Avoid unsafe intermediate state during expensive paths     through heap_update()

  - For the other bug fixes, see the release notes:
    https://www.postgresql.org/docs/9.3/static/release-9-3-1     4.html

Update to version 9.3.13 :

This update fixes several problems which caused downtime for users, including :

  - Clearing the OpenSSL error queue before OpenSSL calls,     preventing errors in SSL connections, particularly when     using the Python, Ruby or PHP OpenSSL wrappers

  - Fixed the 'failed to build N-way joins' planner error

  - Fixed incorrect handling of equivalence in multilevel     nestloop query plans, which could emit rows which didn't     match the WHERE clause.

  - Prevented two memory leaks with using GIN indexes,     including a potential index corruption risk. The release     also includes many other bug fixes for reported issues,     many of which affect all supported versions :

  - Fix corner-case parser failures occurring when     operator_precedence_warning is turned on

  - Prevent possible misbehavior of TH, th, and Y,YYY format     codes in to_timestamp()

  - Correct dumping of VIEWs and RULEs which use ANY (array)     in a subselect

  - Disallow newlines in ALTER SYSTEM parameter values

  - Avoid possible misbehavior after failing to remove a     tablespace symlink

  - Fix crash in logical decoding on alignment-picky     platforms

  - Avoid repeated requests for feedback from receiver while     shutting down walsender

  - Multiple fixes for pg_upgrade

  - Support building with Visual Studio 2015

  - This update also contains tzdata release 2016d, with     updates for Russia, Venezuela, Kirov, and Tomsk.
    http://www.postgresql.org/docs/current/static/release-9-     3-13.html

Update to version 9.3.12 :

  - Fix two bugs in indexed ROW() comparisons

  - Avoid data loss due to renaming files

  - Prevent an error in rechecking rows in SELECT FOR     UPDATE/SHARE

  - Fix bugs in multiple json_ and jsonb_ functions

  - Log lock waits for INSERT ON CONFLICT correctly

  - Ignore recovery_min_apply_delay until reaching a     consistent state

  - Fix issue with pg_subtrans XID wraparound

  - Fix assorted bugs in Logical Decoding

  - Fix planner error with nested security barrier views

  - Prevent memory leak in GIN indexes

  - Fix two issues with ispell dictionaries

  - Avoid a crash on old Windows versions

  - Skip creating an erroneous delete script in pg_upgrade

  - Correctly translate empty arrays into PL/Perl

  - Make PL/Python cope with identifier names

For the full release notes, see:
http://www.postgresql.org/docs/9.4/static/release-9-3-12.html

This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed :

  - CVE-2016-5423: CASE/WHEN with inlining can cause     untrusted pointer dereference (bsc#993454).

  - CVE-2016-5424: Fix client programs' handling of special     characters in database and role names (bsc#993453). For     the non-security issues please refer to

- http://www.postgresql.org/docs/9.4/static/release-9-4-9.html

- http://www.postgresql.org/docs/9.4/static/release-9-4-8.html

- http://www.postgresql.org/docs/9.4/static/release-9-4-7.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed :

  - CVE-2016-5423: CASE/WHEN with inlining can cause     untrusted pointer dereference (bsc#993454).

  - CVE-2016-5424: Fix client programs' handling of special     characters in database and role names (bsc#993453).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql93 to version 9.3.14 fixes the several issues. These security issues were fixed :

  - CVE-2016-5423: CASE/WHEN with inlining can cause     untrusted pointer dereference (bsc#993454).

  - CVE-2016-5424: Fix client programs' handling of special     characters in database and role names (bsc#993453).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way PostgreSQL server handled certain SQL statements containing CASE/WHEN commands. A remote, authenticated attacker could use a specially crafted SQL statement to cause PostgreSQL to crash or disclose a few bytes of server memory or possibly execute arbitrary code. (CVE-2016-5423)

A flaw was found in the way PostgreSQL client programs handled database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable client program. (CVE-2016-5424)

The version of PostgreSQL installed on the remote host is 9.1.x prior or equal to 9.1.22, 9.2.x prior or equal to 9.2.17, 9.3.x prior or equal to 9.3.13, or 9.4.x prior or equal to 9.4.8, or 9.5.x prior or equal to 9.5.3 and is affected by multiple vulnerabilities :

 - A flaw is triggered during the handling of specially crafted nest CASE expressions. This may allow an authenticated attacker to crash the database. 
 - A flaw exists in 'pg_get_expr()' that is triggered during the handling of inconsistent values. This may allow an authenticated attacker to crash the database.
 - An overflow condition exists in the 'to_number()' function. The issue is triggered as input strings are not properly validated. This may allow an authenticated attacker to cause a buffer overflow, resulting in a denial of service.

Update to version 9.4.9 per release notes, includes security fixes for CVE-2016-5423 and CVE-2016-5424

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.1.x prior to 9.1.23, 9.2.x prior to 9.2.18, 9.3.x prior to 9.3.14, 9.4.x prior to 9.4.9, or 9.5.x prior to 9.5.4. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists that allows an     authenticated, remote attacker to crash the database via     specially crafted nested CASE expressions.
    (CVE-2016-5423)

  - A flaw exists that is triggered during the handling of     database and role names with embedded special     characters. An unauthenticated, remote attacker can     exploit this to execute arbitrary code during     administrative operations such as pg_dumpall.
    (CVE-2016-5424)

  - A denial of service vulnerability exists in the     pg_get_expr() function that is triggered during the     handling of inconsistent values. An authenticated,     remote attacker can exploit this to crash the database.

  - An overflow condition exists in the to_number() function     due to improper validation of user-supplied input. An     authenticated, remote attacker can exploit this to cause     a denial of service condition.

Heikki Linnakangas discovered that PostgreSQL incorrectly handled certain nested CASE/WHEN expressions. A remote attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. (CVE-2016-5423)

Nathan Bossart discovered that PostgreSQL incorrectly handled special characters in database and role names. A remote attacker could possibly use this issue to escalate privileges. (CVE-2016-5424).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

PostgreSQL project reports :

Security Fixes nested CASE expressions + database and role names with embedded special characters

- CVE-2016-5423: certain nested CASE expressions can cause the server to crash.

- CVE-2016-5424: database and role names with embedded special characters can allow code injection during administrative operations like pg_dumpall.

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system.

  - CVE-2016-5423     Karthikeyan Jambu Rajaraman discovered that nested     CASE-WHEN expressions are not properly evaluated,     potentially leading to a crash or allowing to disclose     portions of server memory.

  - CVE-2016-5424     Nathan Bossart discovered that special characters in     database and role names are not properly handled,     potentially leading to the execution of commands with     superuser privileges, when a superuser executes     pg_dumpall or other routine maintenance operations.

ID	Name	Product	Family	Severity
100141	FreeBSD : PostgreSQL vulnerabilities (414c18bf-3653-11e7-9550-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
99820	EulerOS 2.0 SP1 : postgresql (EulerOS-SA-2016-1058)	Nessus	Huawei Local Security Checks	high
99417	openSUSE Security Update : postgresql93 (openSUSE-2017-472)	Nessus	SuSE Local Security Checks	high
96474	GLSA-201701-33 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
95856	Scientific Linux Security Update : postgresql on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	high
95352	CentOS 7 : postgresql (CESA-2016:2606)	Nessus	CentOS Local Security Checks	high
94820	Fedora 25 : postgresql (2016-765bb26915)	Nessus	Fedora Local Security Checks	high
94725	Oracle Linux 7 : postgresql (ELSA-2016-2606)	Nessus	Oracle Linux Local Security Checks	high
94569	RHEL 7 : postgresql (RHSA-2016:2606)	Nessus	Red Hat Local Security Checks	high
93997	openSUSE Security Update : postgresql94 (openSUSE-2016-1161)	Nessus	SuSE Local Security Checks	high
93825	openSUSE Security Update : postgresql93 (openSUSE-2016-1140)	Nessus	SuSE Local Security Checks	high
93808	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2016:2418-1)	Nessus	SuSE Local Security Checks	high
93807	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2016:2415-1)	Nessus	SuSE Local Security Checks	high
93806	SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2016:2414-1)	Nessus	SuSE Local Security Checks	high
93539	Amazon Linux AMI : postgresql92 / postgresql93,postgresql94 (ALAS-2016-747)	Nessus	Amazon Linux Local Security Checks	high
9552	PostgreSQL 9.1.x < 9.1.23 / 9.2.x < 9.2.18 / 9.3.x < 9.3.14 / 9.4.x < 9.4.9 / 9.5.x < 9.5.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
93087	Fedora 23 : postgresql (2016-5486a6dfc0)	Nessus	Fedora Local Security Checks	high
93085	Fedora 24 : postgresql (2016-30b01bdedd)	Nessus	Fedora Local Security Checks	high
93050	PostgreSQL 9.1.x < 9.1.23 / 9.2.x < 9.2.18 / 9.3.x < 9.3.14 / 9.4.x < 9.4.9 / 9.5.x < 9.5.4 Multiple Vulnerabilities	Nessus	Databases	high
93047	Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerabilities (USN-3066-1)	Nessus	Ubuntu Local Security Checks	high
92929	FreeBSD : PostgreSQL -- Denial-of-Service and Code Injection Vulnerabilities (ca16fd0b-5fd1-11e6-a6f2-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
92875	Debian DSA-3646-1 : postgresql-9.4 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-5424

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high