It was discovered that PostgreSQL incorrectly checked permissions on functions called by a trigger. An attacker could attach a trigger to a table they owned and possibly escalate privileges. (CVE-2012-0866)

It was discovered that PostgreSQL incorrectly truncated SSL certificate name checks to 32 characters. If a host name was exactly 32 characters, this issue could be exploited by an attacker to spoof the SSL certificate. This issue affected Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. (CVE-2012-0867)

It was discovered that the PostgreSQL pg_dump utility incorrectly filtered line breaks in object names. An attacker could create object names that execute arbitrary SQL commands when a dump script is reloaded. (CVE-2012-0868).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0677 advisory.

    - Back-port upstream fixes for CVE-2012-0866 and CVE-2012-0868     Resolves: #812070

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Postgresql was updated to the security and bugfix release 9.1.3 :

  - Require execute permission on the trigger function for     'CREATE TRIGGER' (CVE-2012-0866, bnc#749299).

  - Remove arbitrary limitation on length of common name in     SSL certificates (CVE-2012-0867, bnc#749301).

  - Convert newlines to spaces in names written in pg_dump     comments (CVE-2012-0868, bnc#749303).

  - See the release notes for the rest of the changes:
    http://www.postgresql.org/docs/9.1/static/release.html     /usr/share/doc/packages/postgresql/HISTORY

  - This also fixes bnc#701489.

The version of PostgreSQL installed on the remote host is 8.3.x prior to 8.3.18, and is, therefore, potentially affected by multiple vulnerabilities :

  - Permissions on a function called by a trigger are not     properly checked. (CVE-2012-0866)   
  - Line breaks in object names can be exploited to execute     arbitrary SQL commands when reloading a pg_dump file.
    (CVE-2012-0868)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-570:01 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL     constructs (including transactions, subselects and user-defined types and functions). The postgresql     package includes the client programs and libraries that you'll need to access a PostgreSQL DBMS server.
    These PostgreSQL client programs are programs that directly manipulate the internal structure of     PostgreSQL databases on a PostgreSQL server. These client programs can be located on the same machine with     the PostgreSQL server, or may be on a remote machine which accesses a PostgreSQL server over a network     connection. This package contains the docs in HTML for the whole package, as well as command-line     utilities for managing PostgreSQL databases on a PostgreSQL server.
    If you want to manipulate a PostgreSQL database on a remote PostgreSQL server, you need this package. You     also need to install this package if you're installing the postgresql-server package.
    Security issues fixed with this release:
    CVE-2012-0866     CVE-2012-0868     No description available at the time of writing, please use the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

PostgreSQL is an advanced object-relational database management system (DBMS).

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

ID	Name	Product	Family	Published	Updated	Severity
58168	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1378-1)	Nessus	Ubuntu Local Security Checks	2/29/2012	9/19/2019	medium
68528	Oracle Linux 5 : postgresql (ELSA-2012-0677)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
74756	openSUSE Security Update : postgresql (openSUSE-SU-2012:1173-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
63355	PostgreSQL 8.3 < 8.3.18 Multiple Vulnerabilities	Nessus	Databases	12/28/2012	1/22/2026	high
284271	MiracleLinux 3 : postgresql-8.1.23-4.0.1.AXS3 (AXSA:2012-570:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical
69689	Amazon Linux AMI : postgresql8 (ALAS-2012-82)	Nessus	Amazon Linux Local Security Checks	9/4/2013	4/18/2018	medium
61317	Scientific Linux Security Update : postgresql on SL5.x i386/x86_64 (20120521)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

critical

medium

high

critical

medium

medium