SuSE9 Security Update : PostgreSQL (YOU Patch Number 12571)
medium Nessus Plugin ID 44050
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote SuSE 9 host is missing a security-related patch.Description
The following bugs have been fixed :- An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions.
(CVE-2009-4136)
- Embedded null bytes in the common name of SSL certificates could bypass certificate hostname checks.
(CVE-2009-4034)
PostgreSQL was updated to the next upstream patchlevel update which also includes several bugfixes. See the package changelog for details.
Solution
Apply YOU patch number 12571.See Also
Plugin Details
Severity: Medium
ID: 44050
File Name: suse9_12571.nasl
Version: 1.8
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 1/19/2010
Updated: 1/14/2021
Dependencies: ssh_get_info.nasl
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:suse:suse_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Patch Publication Date: 1/14/2010
Reference Information
CVE: CVE-2009-4034, CVE-2009-4136
CWE: 310