PostgreSQL 8.3.x < 8.3.18 Multiple Vulnerabilities

Medium Nessus Network Monitor Plugin ID 6336


The remote database server is vulnerable to multiple attack vectors.


Versions of PostgreSQL 8.3.x earlier than 8.3.18 are potentially affected by the following vulnerabilities :

- Permissions on a function called by a trigger are not properly checked. (CVE-2012-0866)

- SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third party certificates. (CVE-2012-0867)

- Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pg_dump file. (CVE-2012-0868)


Upgrade to PostgreSQL 8.3.18 or later.

See Also

Plugin Details

Severity: Medium

ID: 6336

File Name: 6336.prm

Family: Database

Published: 2012/02/28

Modified: 2016/01/21

Dependencies: 8704

Risk Information

Risk Factor: Medium


Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C


Base Score: 6.3

Temporal Score: 5.5


Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:postgresql:postgresql

Patch Publication Date: 2012/02/27

Vulnerability Publication Date: 2012/02/27

Reference Information

CVE: CVE-2012-0866, CVE-2012-0867, CVE-2012-0868

BID: 52188