Debian DSA-2491-1 : postgresql-8.4 - several vulnerabilities

medium Nessus Plugin ID 59769

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Two vulnerabilities were discovered in PostgreSQL, a SQL database server :

- CVE-2012-2143 The crypt(text, text) function in the pgcrypto contrib module did not handle certain passwords correctly when producing traditional DES-based hashes. Characters after the first 0x80 byte were ignored.

- CVE-2012-2655 SECURITY DEFINER and SET attributes for a call handler of a procedural language could crash the database server.

In addition, this update contains reliability and stability fixes from the 8.4.12 upstream release.

Solution

Upgrade the postgresql-8.4 packages.

For the stable distribution (squeeze), this problem has been fixed in version 8.4.12-0squeeze1.

Plugin Details

Severity: Medium

ID: 59769

File Name: debian_DSA-2491.nasl

Version: 1.14

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 6/29/2012

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.48

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:6.0, p-cpe:/a:debian:debian_linux:postgresql-8.4

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 6/9/2012

Reference Information

CVE: CVE-2012-2143, CVE-2012-2655

BID: 53729, 53812

DSA: 2491

Detections

Analytics