Detections
Analytics
GLSA-200502-08 : PostgreSQL: Multiple vulnerabilities
high Nessus Plugin ID 16445
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-200502-08 (PostgreSQL: Multiple vulnerabilities)PostgreSQL's contains several vulnerabilities:
John Heasman discovered that the LOAD extension is vulnerable to local privilege escalation (CAN-2005-0227).
It is possible to bypass the EXECUTE permission check for functions (CAN-2005-0244).
The PL/PgSQL parser is vulnerable to heap-based buffer overflow (CAN-2005-0244).
The intagg contrib module is vulnerable to a Denial of Service (CAN-2005-0246).
Impact :
An attacker could exploit this to execute arbitrary code with the privileges of the PostgreSQL server, bypass security restrictions and crash the server.
Workaround :
There is no know workaround at this time.
Solution
All PostgreSQL users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose dev-db/postgresql
See Also
Plugin Details
Severity: High
ID: 16445
File Name: gentoo_GLSA-200502-08.nasl
Version: 1.19
Type: local
Family: Gentoo Local Security Checks
Published: 2/14/2005
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:postgresql, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Patch Publication Date: 2/7/2005
Reference Information
CVE: CVE-2005-0227, CVE-2005-0244, CVE-2005-0245, CVE-2005-0246