SuSE 11.1 Security Update : PostgreSQL (SAT Patch Number 6697)

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote SuSE 11 host is missing one or more security updates.

Description :

This update provides PostgreSQL 8.3.20. As part of this update, the
packaging scheme has been changed to accomodate an optional parallel
installation of newer PostgreSQL versions.

The changes in 8.3.20 are :

- Prevent access to external files/URLs via XML entity
references. xml_parse() would attempt to fetch external
files or URLs as needed to resolve DTD and entity
references in an XML value, thus allowing unprivileged
database users to attempt to fetch data with the
privileges of the database server. (CVE-2012-3489,
bnc#776524)

- Prevent access to external files/URLs via
'contrib/xml2''s xslt_process(). libxslt offers the
ability to read and write both files and URLs through
stylesheet commands, thus allowing unprivileged database
users to both read and write data with the privileges of
the database server. Disable that through proper use of
libxslt's security options. (CVE-2012-3488, bnc#776523).
Also, remove xslt_process()'s ability to fetch documents
and stylesheets from external files/URLs.

- Fix incorrect password transformation in
contrib/pgcrypto's DES crypt() function. If a password
string contained the byte value 0x80, the remainder of
the password was ignored, causing the password to be
much weaker than it appeared. With this fix, the rest of
the string is properly included in the DES hash. Any
stored password values that are affected by this bug
will thus no longer match, so the stored values may need
to be updated. (CVE-2012-2143)

- Ignore SECURITY DEFINER and SET attributes for a
procedural language's call handler. Applying such
attributes to a call handler could crash the server.
(CVE-2012-2655)

- Allow numeric timezone offsets in timestamp input to be
up to 16 hours away from UTC. Some historical time zones
have offsets larger than 15 hours, the previous limit.
This could result in dumped data values being rejected
during reload.

- Fix timestamp conversion to cope when the given time is
exactly the last DST transition time for the current
timezone. This oversight has been there a long time, but
was not noticed previously because most DST-using zones
are presumed to have an indefinite sequence of future
DST transitions.

- Fix text to name and char to name casts to perform
string truncation correctly in multibyte encodings.

- Fix memory copying bug in to_tsquery().

- Fix slow session startup when pg_attribute is very
large. If pg_attribute exceeds one-fourth of
shared_buffers, cache rebuilding code that is sometimes
needed during session start would trigger the
synchronized-scan logic, causing it to take many times
longer than normal. The problem was particularly acute
if many new sessions were starting at once.

- Ensure sequential scans check for query cancel
reasonably often. A scan encountering many consecutive
pages that contain no live tuples would not respond to
interrupts meanwhile.

- Show whole-row variables safely when printing views or
rules. Corner cases involving ambiguous names (that is,
the name could be either a table or column name of the
query) were printed in an ambiguous way, risking that
the view or rule would be interpreted differently after
dump and reload. Avoid the ambiguous case by attaching a
no-op cast.

- Ensure autovacuum worker processes perform stack depth
checking properly. Previously, infinite recursion in a
function invoked by auto-ANALYZE could crash worker
processes.

- Fix logging collector to not lose log coherency under
high load. The collector previously could fail to
reassemble large messages if it got too busy.

- Fix logging collector to ensure it will restart file
rotation after receiving SIGHUP.

- Fix PL/pgSQL's GET DIAGNOSTICS command when the target
is the function's first variable.

- Fix several performance problems in pg_dump when the
database contains many objects. pg_dump could get very
slow if the database contained many schemas, or if many
objects are in dependency loops, or if there are many
owned sequences.

- Fix contrib/dblink's dblink_exec() to not leak temporary
database connections upon error.

See also :

https://bugzilla.novell.com/show_bug.cgi?id=760511
https://bugzilla.novell.com/show_bug.cgi?id=765069
https://bugzilla.novell.com/show_bug.cgi?id=766799
https://bugzilla.novell.com/show_bug.cgi?id=767505
https://bugzilla.novell.com/show_bug.cgi?id=770193
https://bugzilla.novell.com/show_bug.cgi?id=773771
https://bugzilla.novell.com/show_bug.cgi?id=774616
https://bugzilla.novell.com/show_bug.cgi?id=774617
https://bugzilla.novell.com/show_bug.cgi?id=775399
https://bugzilla.novell.com/show_bug.cgi?id=775402
https://bugzilla.novell.com/show_bug.cgi?id=776523
https://bugzilla.novell.com/show_bug.cgi?id=776524
http://support.novell.com/security/cve/CVE-2012-2143.html
http://support.novell.com/security/cve/CVE-2012-2655.html
http://support.novell.com/security/cve/CVE-2012-3488.html
http://support.novell.com/security/cve/CVE-2012-3489.html

Solution :

Apply SAT patch number 6697.

Risk factor :

Medium / CVSS Base Score : 4.9
(CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N)

Family: SuSE Local Security Checks

Nessus Plugin ID: 64216 ()

Bugtraq ID:

CVE ID: CVE-2012-2143
CVE-2012-2655
CVE-2012-3488
CVE-2012-3489

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now