FreeBSD : postgresql -- multiple vulnerabilities (65c8ecf9-2adb-11db-a6e2-000e0c2e438a)

High Nessus Plugin ID 22210


The remote FreeBSD host is missing one or more security-related updates.


Multiple vulnerabilities had been reported in various versions of PostgreSQL :

- The EXECUTE restrictions can be bypassed by using the AGGREGATE function, which is missing a permissions check.

- A buffer overflow exists in gram.y which could allow an attacker to execute arbitrary code by sending a large number of arguments to a refcursor function, found in gram.y

- The intagg contributed module allows an attacker to crash the server (Denial of Service) by constructing a malicious crafted array.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 22210

File Name: freebsd_pkg_65c8ecf92adb11dba6e2000e0c2e438a.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2006/08/14

Modified: 2013/06/21

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:ja-postgresql, p-cpe:/a:freebsd:freebsd:postgresql, p-cpe:/a:freebsd:freebsd:postgresql-server, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2006/08/13

Vulnerability Publication Date: 2005/02/01

Reference Information

CVE: CVE-2005-0244, CVE-2005-0245, CVE-2005-0246

Secunia: 12948

CWE: 264