openSUSE Security Update : postgresql92 (openSUSE-SU-2013:0628-1)

High Nessus Plugin ID 74962

Synopsis

The remote openSUSE host is missing a security update.

Description

postgresql was updated to version 9.2.4 (bnc#812525) :

- CVE-2013-1899: Fix insecure parsing of server command-line switches. A connection request containing a database name that begins with '-' could be crafted to damage or destroy files within the server's data directory, even if the request is eventually rejected.

- CVE-2013-1900: Reset OpenSSL randomness state in each postmaster child process. This avoids a scenario wherein random numbers generated by 'contrib/pgcrypto' functions might be relatively easy for another database user to guess. The risk is only significant when the postmaster is configured with ssl = on but most connections don't use SSL encryption.

- CVE-2013-1901: Make REPLICATION privilege checks test current user not authenticated user. An unprivileged database user could exploit this mistake to call pg_start_backup() or pg_stop_backup(), thus possibly interfering with creation of routine backups.

- See the release notes for the rest of the changes:
http://www.postgresql.org/docs/9.2/static/release-9-2-4.
html /usr/share/doc/packages/postgresql92/HISTORY

Solution

Update the affected postgresql92 packages.

See Also

https://www.postgresql.org/docs/9.2/release-9-2-4.html

https://bugzilla.novell.com/show_bug.cgi?id=812525

https://lists.opensuse.org/opensuse-updates/2013-04/msg00045.html

Plugin Details

Severity: High

ID: 74962

File Name: openSUSE-2013-306.nasl

Version: 1.5

Type: local

Agent: unix

Published: 2014/06/13

Updated: 2020/06/04

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 8.5

Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:libecpg6, p-cpe:/a:novell:opensuse:libecpg6-32bit, p-cpe:/a:novell:opensuse:libecpg6-debuginfo, p-cpe:/a:novell:opensuse:libecpg6-debuginfo-32bit, p-cpe:/a:novell:opensuse:libpq5, p-cpe:/a:novell:opensuse:libpq5-32bit, p-cpe:/a:novell:opensuse:libpq5-debuginfo, p-cpe:/a:novell:opensuse:libpq5-debuginfo-32bit, p-cpe:/a:novell:opensuse:postgresql92, p-cpe:/a:novell:opensuse:postgresql92-contrib, p-cpe:/a:novell:opensuse:postgresql92-contrib-debuginfo, p-cpe:/a:novell:opensuse:postgresql92-debuginfo, p-cpe:/a:novell:opensuse:postgresql92-debugsource, p-cpe:/a:novell:opensuse:postgresql92-devel, p-cpe:/a:novell:opensuse:postgresql92-devel-debuginfo, p-cpe:/a:novell:opensuse:postgresql92-libs-debugsource, p-cpe:/a:novell:opensuse:postgresql92-plperl, p-cpe:/a:novell:opensuse:postgresql92-plperl-debuginfo, p-cpe:/a:novell:opensuse:postgresql92-plpython, p-cpe:/a:novell:opensuse:postgresql92-plpython-debuginfo, p-cpe:/a:novell:opensuse:postgresql92-pltcl, p-cpe:/a:novell:opensuse:postgresql92-pltcl-debuginfo, p-cpe:/a:novell:opensuse:postgresql92-server, p-cpe:/a:novell:opensuse:postgresql92-server-debuginfo, cpe:/o:novell:opensuse:12.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2013/04/05

Reference Information

CVE: CVE-2013-1899, CVE-2013-1900, CVE-2013-1901