The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-570:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a remote PostgreSQL server, you need this package. You     also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
    CVE-2012-0866     CVE-2012-0868     No description available at the time of writing, please use the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

PostgreSQL is an advanced object-relational database management system (DBMS).

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

The version of PostgreSQL installed on the remote host is 8.3.x prior to 8.3.18, and is, therefore, potentially affected by multiple vulnerabilities :

  - Permissions on a function called by a trigger are not     properly checked. (CVE-2012-0866)   
  - Line breaks in object names can be exploited to execute     arbitrary SQL commands when reloading a pg_dump file.
    (CVE-2012-0868)

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

Updated postgresql84 and postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

These updated packages upgrade PostgreSQL to version 8.4.11, which fixes these issues as well as several data-corruption issues and lesser non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

The remote host is affected by the vulnerability described in GLSA-201209-24 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could spoof SSL connections. Furthermore, a remote       authenticated attacker could cause a Denial of Service, read and write       arbitrary files, inject SQL commands into dump scripts, or bypass       database restrictions to execute database functions.
    A context-dependent attacker could more easily obtain access via       authentication attempts with an initial substring of the intended       password.
  Workaround :

    There is no known workaround at this time.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-661:02 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a remote PostgreSQL server, you need this package. You     also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
     CVE-2012-0866     CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x     before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER,     which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by     installing the trigger on an attacker-owned table.
     CVE-2012-0867     PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to     only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections     when the host name is exactly 32 characters.
     CVE-2012-0868     CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x     before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL     commands via a crafted file containing object names with newlines, which are inserted into an SQL script     that is used when the database is restored.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
284271	MiracleLinux 3 : postgresql-8.1.23-4.0.1.AXS3 (AXSA:2012-570:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical
61317	Scientific Linux Security Update : postgresql on SL5.x i386/x86_64 (20120521)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
63355	PostgreSQL 8.3 < 8.3.18 Multiple Vulnerabilities	Nessus	Databases	12/28/2012	1/22/2026	high
69689	Amazon Linux AMI : postgresql8 (ALAS-2012-82)	Nessus	Amazon Linux Local Security Checks	9/4/2013	4/18/2018	medium
59214	CentOS 5 / 6 : postgresql / postgresql84 (CESA-2012:0678)	Nessus	CentOS Local Security Checks	5/22/2012	1/4/2021	medium
62380	GLSA-201209-24 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	9/29/2012	1/6/2021	medium
283904	MiracleLinux 4 : postgresql-8.4.12-1.0.1.AXS4 (AXSA:2012-661:02)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical

Detections

Analytics

Plugins Search

critical

medium

high

medium

medium

medium

critical